The Nightly Build.
Feature

Tether and Circle froze Binance’s stolen stablecoins and had no reach over the rest

Elliptic counts 44% of the $6.43 billion as frozen or seized, almost all of it stablecoin, where Bybit’s 2025 haul held no stablecoin and saw 3% to 3.84% frozen.

5 min read2026-11-02

Over half the haul had an issuer to call

A freeze reaches only tokens that have an issuer, and only those the thief has not yet swapped out. About $6.3 billion left Binance’s wallets on 29 October by Binance’s estimate, $6.36 billion by TRM Labs’ trace and $6.43 billion by Elliptic’s.123 Most moved in about 20 minutes from 20:05 UTC.2 Elliptic counts $3.46 billion of its total as stablecoin.3

The frozen tally runs from about $2.7 billion (TRM, 30 October) to $2.85 billion (Elliptic, 1 November) to about $3 billion (Binance, method unstated).231 All are days old and still moving. Frozen is not returned: Binance says it is working with partners and law enforcement to recover the frozen assets, and CoinDesk reports none returned.45

Only an administrator can flag an address

A stablecoin contract keeps a blocklist and checks it on transfers, so a listed address cannot move its balance. Tether’s USDT on Ethereum gives its owner addBlackList and destroyBlackFunds, which also sets a blacklisted balance to zero.6 Circle’s USDC restricts blacklist to a designated blacklister.7 Tether froze the main Ethereum wallet 37 minutes after the USDT arrived, and Circle froze 823 million USDC three minutes after that.3

Stablecoin at a flagged address Tether, Circle, Ripple and others Issuer’s blocklist checked on every transfer Transfer reverts balance frozen in place Swap before the flag lands: about $786M in this theft Un-administered asset Bitcoin, XRP, Solana, NEAR No issuer, no blocklist Transfer goes through traced, not stopped Administered non-stablecoin ARB, tokenized gold, WBETH Someone administers it governance or issuer acts Frozen or moved aside $36M in ETH, ARB and OP
Fig. 1 · Three outcomes for a flagged address. Conceptual diagram; the $786 million and $36 million are Elliptic’s figures.3

Nothing stolen on Bitcoin, the XRP Ledger, Solana or NEAR has been frozen, Elliptic reports, because native assets have no issuer that can freeze them.3 The dividing line is whether anyone administers the asset. Arbitrum’s Security Council moved, and Optimism’s governance appears to have moved, about $36 million of ETH, ARB and OP out of the attacker’s reach, and Binance froze its own WBETH.3 Circle did not freeze about $230 million of USDC from April’s Drift exploit and says it freezes only when legally compelled. A Circle spokesperson told American Banker the company froze more than $1.1 billion for Binance, which no on-chain count reproduces: TRM and Elliptic find $823 million to $825 million.823

Most stablecoins froze before the thief could swap them

Read each bar of Fig. 2 from the left: frozen, then swapped out before the freeze, then out of any issuer’s reach.

Two horizontal stacked bars in US dollars. Stablecoins, 3.46 billion stolen: 2.68 billion frozen or seized and 0.79 billion swapped out before the freeze, so 77% frozen. Everything else, 2.97 billion stolen: 0.17 billion frozen and 2.80 billion not frozen, so 6% frozen.
Fig. 2 · Binance haul by asset type, US$ billions, Elliptic’s figures. Frozen stablecoin is derived as 94% of its $2.85 billion and carries about a point of rounding error. Stolen amounts are at theft-time prices and frozen amounts at 1 November prices.3

Before the freezes landed, the attacker converted about $786 million of stablecoins into ETH and TRX, including 434 million USDT into 160,451 ETH at a 12% to 26% loss against market.3 About 77% of the stolen stablecoin ended up frozen, against about 6% of everything else. The issuers froze nearly all the stablecoin still in place when they acted, so the gap came from speed as well as from the asset model.

Bybit’s haul held no stablecoin for an issuer to freeze

The FBI put the 2025 Bybit theft at approximately $1.5 billion.9 Block Scholes read the haul from the chain as 401,347 ETH, 90,376 stETH, 8,000 mETH and 15,000 cmETH, about $1.46 billion, with no stablecoin.10 Bybit’s CEO Ben Zhou counted 3.84% frozen on 21 April 2025, as Decrypt reported,11 up from 3% in early March. Block Scholes found no freeze of the stolen ETH in its 22 February update, and no source says what the 3.84% consists of.

Grouped horizontal bars comparing two thefts. Stablecoin share of the haul: Binance 54%, Bybit 0%. Frozen or seized share of the haul: Binance 44%, Bybit 3% to 3.84%.
Fig. 3 · Stablecoin share and frozen share of each haul. Binance: Elliptic, by dollar value. Bybit: Zhou’s frozen share of about 500,000 ETH, and Block Scholes’ reading of the chain. The Bybit bar shows 3.84%.31011

Two thefts are not a rule, but the mechanism in Fig. 1 predicts the order. The haul with an issuer behind 54% of it saw 44% frozen or seized, and the haul with none saw under 4%.

Binance has walked back its breach path, and the attributions are assessments

Binance’s initial finding, posted by co-CEO Richard Teng on 30 October, was that the incident “may have started with a compromised DevOps engineer’s laptop.” The laptop, he wrote, gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions.12 About 70 minutes later Binance said its later investigation “has uncovered additional points of breach” and did not name them.13 TRM’s assessment is that the attacker compromised Binance’s hot wallet signing infrastructure, and it says the early phishing hypothesis “covers Ethereum and leaves the other chains unexplained.”2

Who attributes the theft, in each holder’s words. These are assessments, not a court finding.
HolderAssessmentStated confidence
TRM LabsTraderTraitor, North Korea’s elite hacking unit.2“high confidence”
Binance“Our investigation has not attributed responsibility to any individual.”12none given
Chainalysis“likely done by DPRK group TraderTraitor due to links to previous hack.”14“likely”
EllipticLinked the theft to TraderTraitor before the FBI spoke.3“likely”
FBINorth Korea “was responsible for the theft of more than $6 billion”; 628 addresses to block. Quoted by BleepingComputer; the FBI’s own page could not be opened.15an attribution
North KoreaHas denied such thefts before and did not respond to Reuters here, per IBTimes.16denial

Whoever is named in the end, Elliptic counts about $3.25 billion that no issuer can freeze, at 1 November prices, across more than 800 addresses. That is $1.42 billion in BTC, $1.32 billion in ETH and $502 million in XRP, Solana, TRX, NEAR and others.3

Sources

  1. Binance · Security Incident Update
  2. TRM Labs · North Korea steals $6.36 billion from Binance
  3. Elliptic · Binance: the largest hack in history
  4. Binance · X post on frozen assets
  5. CoinDesk · Binance opens withdrawals in phases
  6. Blockscout · Tether USDT contract
  7. Circle · stablecoin-evm, Blacklistable.sol
  8. American Banker · $6B Binance heist provokes stablecoin freeze dilemma
  9. FBI IC3 · $1.5 Billion Bybit Hack
  10. Block Scholes · Bybit ETH hack
  11. Decrypt · Bybit CEO on traceable funds
  12. Richard Teng · X post
  13. Binance · X post, additional points of breach
  14. Jonathan Levin · X post
  15. BleepingComputer · FBI links Binance heist to North Korea
  16. IBTimes · FBI and the Binance theft