Binance lost $6.3B. Stablecoins froze in 37 minutes. Bitcoin can't.

Tether, Circle and two smaller issuers froze about $2.4B of the stolen Binance stablecoins. The 18,270 BTC and $911M in ETH and TRX stay with the attacker.

The Editors · Crypto · 7 min read · Oct 31, 2026

By the numbers

$6.3Btaken from Binance's hot wallets on October 29, 2026, most of it in about 20 minutes

37 minfrom the stolen USDT landing in the attacker's wallet to Tether blacklisting it

18,270 BTCabout $1.4B in bitcoin the attacker still holds, with no issuer able to freeze it

$290Min stolen USDC Circle did not freeze after the Drift hack in April 2026

The record Binance hack split on one question: does the stolen token have an issuer with a freeze key? The stablecoins did. Tether, Circle, Ripple and World Liberty Financial froze roughly $2.4 billion of them within hours, and Tether's blacklist landed 37 minutes after the USDT reached the attacker. The bitcoin and the ether had no such key. About $2.4 billion in those assets is still in the attacker's hands, including 18,270 BTC parked in 19 wallets.

If you hold coins on Binance, the exchange says it will pay: it has set aside more than $6.34 billion of company funds, five times its roughly $1.2 billion SAFU emergency fund. If you hold stablecoins anywhere, the lesson cuts both ways. The button that saved half the loot is the same one that can lock your balance, and on Thursday it moved faster for the world's largest exchange than it did for a smaller DeFi protocol in April.

What happened on October 29

At about 20:05 UTC on Thursday, October 29, an attacker began draining Binance hot wallets across ten blockchains. Arkham's on-chain trace puts the total at $6.36 billion, most of it moved between 20:05 and 20:25 UTC. One Ethereum transaction alone swept 64 tokens worth $2.53 billion out of a wallet Arkham labels Binance 14.

Binance's first finding pointed to a compromised DevOps engineer's laptop that gave the attacker access to a service container able to submit withdrawals. Co-CEO Richard Teng later said the breach involved more than one engineer's permissions and that Binance had found no evidence of a private key leak.

TRM Labs attributed the attack with high confidence to TraderTraitor, the North Korean unit tied to the $1.5 billion Bybit theft in February 2025. The new record is more than four times the old one.

The half that could be frozen

The stablecoins moved last and stopped first. American Banker's timeline, in US Eastern time:

4:24 p.m.: 1.6 billion USDT reaches the attacker's wallet.
4:41 p.m.: 780 million USDC arrives, then 43 million more at 4:59.
5:01 p.m.: Tether blacklists the wallet.
5:04 p.m.: Circle freezes the USDC.

Tether's CEO Paolo Ardoino confirmed more than 1.567 billion USDT frozen. Circle froze about $823 million in USDC. Smaller issuers followed: about $40 million in Ripple's RLUSD and $27 million in World Liberty's USD1. Added up, that's roughly $2.4 billion. Binance's own count is about $3 billion frozen across all partners, and Arkham's is $2.7 billion. The figures differ because each counts different tokens at different hours. All three put the frozen share at less than half of the $6.3 billion.

$1.57B$0.82B$0.07B$1.4B$0.91B

View as table

Where the $6.3B stands, by what could stop it
label	Where the $6.3B stands, by what could stop it
USDT frozen by Tether	$1.57B
USDC frozen by Circle	$0.82B
RLUSD and USD1 frozen	$0.07B
Bitcoin held by attacker	$1.4B
Swapped to ETH and TRX	$0.91B

Source: Tether, Circle via CoinDesk; Ripple, WLFI via 24/7 Wall St.; Arkham, Oct 30, 2026

The half that couldn't

Bitcoin and ether have no issuer, so nobody holds a key to stop them. The attacker split 18,270.2 BTC into 19 addresses of about 1,000 BTC each, worth about $1.4 billion at Friday's prices. Arkham also traced $911 million that had already been swapped into ETH and TRX, two more assets with no freeze function.

That's the part the attacker keeps. Freezing a token also doesn't return it: CNBC notes that Tether and Circle can burn frozen coins and reissue them to the victim, but there's no standard timeline, and recovery has taken months or years before.

Who decides when the freeze button gets pressed

Here the story turns from Binance to anyone holding a stablecoin.

Tether's terms of service, last updated February 26, let it freeze tokens when required by law or when it sees fit. Ardoino's post announcing the freeze didn't say whether law enforcement had asked for it. On Thursday the decision took Tether 37 minutes.

Compare April. When the Drift protocol was hacked, Circle was criticized for not freezing $290 million in stolen USDC. Anton Golub of Forte put the gap plainly: "When Binance gets hacked, the industry freezes nearly $3 billion within hours. When smaller players get hacked, we hear about court orders and legal restrictions." Circle changed its freeze policy in May, the month after Drift. Binance had invested $100 million in Circle in September.

The federal rules don't settle it. The GENIUS Act requires issuers to obey "lawful orders" from a court or federal agency. The OCC's final rule of October 21, which takes effect with the Act on January 18, 2027, doesn't define "freeze" or "seize" and leaves both to a separate anti-money-laundering rule that hasn't been finalized. So the question of when an issuer may freeze without a court order has no written federal answer yet. We covered the missed deadlines in why regulators missed the GENIUS Act deadline.

Our read: on Thursday the freeze worked the way its defenders say it should, and it worked because Binance is the counterparty issuers least want to lose. It was a judgment call, and a smaller holder can't count on the same one.

What it means if you hold coins on Binance

Binance says customers won't absorb the loss. Of the $6.34 billion it set aside, $5 billion was already held in the same tokens the attacker took; the rest it's buying on the market and over the counter, and it flagged settlement delays from that. SAFU alone, at about $1.2 billion, would have covered under a fifth.

Withdrawals were still suspended as of Friday. Teng said he was hopeful they would reopen before Sunday, with a proof-of-reserves report to follow by Monday. That date comes from Teng alone; treat it as a target. An analyst quoted by CNBC said the breach does not appear to create meaningful solvency risk for an exchange with about $155 billion in assets under management.

Two practical points. The proof-of-reserves report is the document to read when it lands: check that the BTC and ETH lines match what users are owed, since those are the assets Binance must rebuy. And coins you control yourself sit outside any exchange's hot wallet, with their own risks, as the Coldcard bug in our earlier piece showed.

What to watch

The proof-of-reserves report Binance promised, and whether the BTC and ETH it buys back appear in it.
Whether Tether and Circle burn and reissue the frozen $2.4 billion to Binance, and how fast.
The pending anti-money-laundering rule, the first federal text likely to say when an issuer may freeze without a court order.
Movement out of the 19 bitcoin wallets.