Table of Contents
The Binance hack on 29 October is the largest crypto theft on record: an attacker moved about $6.36 billion out of Binance wallets on ten blockchains, most of it in roughly 20 minutes, and TRM Labs attributes it with high confidence to TraderTraitor, a North Korean state-sponsored unit (TRM Labs).
What stopped it from being worse was not Binance. It was a handful of stablecoin issuers flipping a switch most crypto users never think about. Tether froze more than 1.567 billion USDT (Paolo Ardoino on X) and Circle froze more than 800 million USDC within the first hour of alarms (Jeremy Allaire on X).
Bitcoin has no off switch. Dollars on a blockchain do.
This analysis covers the stablecoin side of the story: how each issuer's freeze works, how much each one actually froze against what was taken, what could never be frozen, how frozen tokens get back to their owner, and what the episode does to the debate over issuer control under the GENIUS Act.
Key Takeaways
- Binance puts the impact at about $6.3 billion and says around $3 billion is frozen; it will cover all losses from its SAFU fund and company funds (Binance on X).
- TRM Labs counts about $2.67 billion in stablecoins frozen by Tether, Circle, Ripple and World Liberty Financial, plus about $30 million rescued on Arbitrum (TRM Labs).
- Circle froze the full 823 million USDC before any of it moved, while 1.76 billion USDT, 71% of the USDT taken, is locked (Bitquery).
- The attacker still holds 18,270 BTC and more than 420,000 ETH, about $2.4 billion that no issuer can freeze (TRM Labs).
- A freeze only stops movement; returning USDT or USDC to a victim needs a court order or seizure warrant, then a burn and reissue (CNBC).
What happened in the Binance hack
The first theft hit the XRP Ledger at 20:05 UTC, Solana and Optimism followed after 20:10 UTC and Bitcoin at 20:20 UTC, and on Ethereum the attacker used an EIP-7702 delegation backed by 50 pre-signed authorizations to turn a Binance hot wallet into a sweeper it controlled (TRM Labs). One Ethereum transaction alone moved 167,464 ETH and 1.615 billion USDT.
Binance's first findings point to a compromised DevOps engineer's laptop that gave the attacker access to a service container able to submit unauthorized withdrawal transactions, and the exchange says it found no evidence of a private key leak (Binance on X). Chainalysis also points to North Korea (Chainalysis on X).
Deposits are running normally, but withdrawals remain paused, and co-CEO Yi He said Binance expects to begin resuming them in the next 48 hours (Yi He on X). Bitcoin fell more than 4% to $77,994.96 and Circle shares dropped about 5% in after-hours trading (CNBC).
How much each stablecoin issuer froze
Headline figures came from executives on X in the first hours. TRM Labs then checked what it could see on-chain as of 00:30 UTC on 30 October, and the two sets of numbers do not always match (TRM Labs). Here they are side by side.
| Issuer and token | Publicly stated freeze | Confirmed on-chain (TRM) | Taken from Binance (TRM) | Share frozen (SCI estimate) |
|---|---|---|---|---|
| Tether, USDT | More than 1.567 billion USDT (Ardoino) | About 1.773 billion USDT across Ethereum, Tron, Avalanche and Polygon (TRM) | 2.488 billion USDT (1.875 billion on Ethereum, 612.7 million on Tron) (TRM) | About 71% |
| Circle, USDC | More than 800 million USDC (Allaire) | About 825 million USDC, including 1.56 million bridged from Avalanche (TRM) | 823 million USDC (TRM) | About 100% |
| Ripple, RLUSD | About $200 million, per Binance's Yi He (Disruption Banking) | 40.5 million RLUSD (TRM) | 88.5 million RLUSD (TRM) | About 46% of tracked RLUSD |
| World Liberty Financial, USD1 and WLFI | $27 million USD1, plus about $2 million in WLFI (Disruption Banking) | 27.8 million USD1 (TRM) | Not published | Unavailable |
| Arbitrum Security Council, ETH and ARB | About $30.5 million (Disruption Banking) | 8,426 ETH and 74.6 million ARB, about $30 million (TRM) | About $39 million across Arbitrum, Optimism and Base | Not a stablecoin freeze |
Share frozen is Stablecoin Insider's division of TRM's confirmed on-chain freeze by TRM's count of each token taken; Binance's own running total moved from $2.54 billion late on Thursday (CNBC) to around $3 billion by Friday morning (CNBC).
Two gaps stand out. Ripple's $200 million figure came from Binance, and TRM could confirm only 40.5 million RLUSD frozen on-chain after the attacker sold 48 million RLUSD through decentralized exchanges between 21:42 and 22:01 UTC (TRM Labs). Ripple also froze RLUSD in the compromised hot wallet so new deposits could not be swept, which may explain part of the difference, but it has not published a breakdown.
Binance's running total is also higher than TRM's, roughly $3 billion against about $2.7 billion, and it does not break the total down by asset (CNBC). Until it does, treat around $2.7 billion as the confirmed floor.
Stablecoins were half the haul and most of the rescue
Add up TRM's chain breakdown and the three largest stablecoins taken, USDT, USDC and RLUSD, come to about $3.40 billion, or roughly 53% of the $6.36 billion total (TRM Labs). Stablecoin Insider's tally of TRM's confirmed freezes for those three tokens is about $2.64 billion, which means issuers locked roughly 78% of the stablecoins stolen.
Compare that with the assets that have no issuer. The 18,270 BTC, worth about $1.47 billion, the 233.46 million XRP, about $296 million, and the 970,500 SOL, about $96 million, were frozen at 0% because no one can freeze them at the token level (TRM Labs).
| Asset taken | Value at theft (TRM) | Who can freeze it | Frozen so far |
|---|---|---|---|
| USDT, USDC, RLUSD | About $3.40 billion (TRM) | The issuer, at the token contract | About 78% (SCI estimate) |
| Bitcoin, 18,270 BTC | About $1.47 billion (TRM) | No one at the token level; exchanges can block deposits | 0% |
| XRP, 233.46 million | About $296 million (TRM) | No one; XRPL clawback does not apply to XRP itself | 0% |
| Solana, 970,500 SOL | About $96 million (TRM) | No one at the token level | 0% |
| Ether on Arbitrum | 8,426 ETH rescued (TRM, Arbitrum forum) | Arbitrum's Security Council, by emergency contract upgrade | Partial |
The attacker understood this. In the first hours it sold about 325 million USDT to market makers through UniswapX and other intent-based contracts for about 122,300 ETH, paying a discount of more than 10% to escape the freeze (TRM Labs). Bitquery counts $729 million of stolen USDT that was swapped into ETH and TRX before Tether's freezes landed, and six of Tether's 11 freezes hit wallets that were already empty (Bitquery).
How a stablecoin freeze actually works
Every major dollar stablecoin ships with an admin control built into the token itself. In Circle's USDC contract, a blacklister role can block an address, after which it cannot transfer, receive, mint or burn USDC (Circle stablecoin-evm docs). You can check any address yourself with our guide to USDC blacklist status.
Tether's Ethereum contract has the same idea with different names: addBlackList blocks an address, and destroyBlackFunds wipes the balance of a blacklisted address so it can later be reissued (USDT contract on Etherscan). Ripple's RLUSD terms let Ripple freeze or burn tokens for legal and compliance reasons (Ripple), and on the XRP Ledger an issuer can claw back issued tokens if it enabled that setting before trust lines existed (XRPL docs).
For a deeper primer on which tokens can be frozen and why, our explainer covers the full list.
Frozen is not recovered: the freeze, burn and reissue path
"A freeze stops the money from moving, and recovery follows through legal process," TRM Labs' Ari Redbord told CNBC, adding that law enforcement usually gets a court order or seizure warrant before issuers release or reissue assets (CNBC).
| Step | What happens | Who acts | Status in the Binance hack |
|---|---|---|---|
| 1. Freeze | The attacker's address is blacklisted, so the tokens cannot move | Issuer | Done for about $2.67 billion in stablecoins (TRM) |
| 2. Legal process | A court order or seizure warrant names the frozen funds | Law enforcement and courts | Not yet public (CNBC) |
| 3. Burn | The issuer destroys the frozen balance at the contract | Issuer | Pending |
| 4. Reissue | Equal new tokens are minted to the rightful owner | Issuer | Pending |
Chainalysis' Eric Jardine told CNBC there is no standard recovery timeline, and that a technical freeze can happen quickly while returning funds can take months or years (CNBC). That is why Binance's pledge matters: it says customer losses are covered from the SAFU fund and company funds regardless of how long reissuance takes (Binance on X).
Fundstrat's Sean Farrell estimates about $3.3 billion remained unfrozen and that the SAFU fund, worth about $1.2 billion, could cover roughly a third of that if frozen stablecoins are eventually returned (CNBC).
Holding stablecoins on an exchange or in a wallet that just got hit? Our first-hour checklist covers what to do, who to contact and how to report a stablecoin theft.
The issuer-control debate after the Binance hack
Redbord called stablecoins "the most recoverable asset class in crypto because the issuer controls the token contract" (CNBC). The Binance hack is the strongest evidence yet for that claim, and it lands just as US rules make that control mandatory.
Under the GENIUS Act, a permitted payment stablecoin issuer may issue only if it has the technological capability to comply with any lawful order to seize, freeze, burn or prevent the transfer of its coins, and foreign issuers sold in the US face the same test (GENIUS Act, Public Law 119-27). Our GENIUS Act hub covers the rest of the framework.
The statute is written around lawful orders, but Tether's first freeze landed 37 minutes after the main sweep, long before any court could act (TRM Labs). Circle said it acted in coordination with law enforcement (Jeremy Allaire on X). The speed that saved billions came from issuer discretion, and that same discretion is what critics of freezable stablecoins worry about.
Expect both sides to use this case. Supporters will point to roughly $2.7 billion locked in hours. Critics will point out that the same switch can block any address, and that the attacker still escaped with about $729 million in USDT by swapping first (Bitquery).
If you hold USDT and want to confirm an address is not on Tether's list, our step-by-step guide shows how.
FAQ
How much was stolen in the Binance hack?
Who is behind the Binance hack?
How much did Tether and Circle freeze?
Tether said more than 1.567 billion USDT and Circle more than 800 million USDC; TRM's on-chain count is about 1.773 billion USDT and about 825 million USDC (TRM Labs).
Will Binance users lose money?
Binance says user funds are safe and it will cover all losses from its SAFU fund and company funds; withdrawals are expected to start resuming within 48 hours (FinanceFeeds).
Can frozen USDT or USDC be returned?
Yes, usually after a court order or seizure warrant: the issuer burns the frozen balance and reissues new tokens to the rightful owner (CNBC).
Why could the stolen Bitcoin not be frozen?
Bitcoin has no issuer and no admin key, so investigators can only trace it and intercept it at exchanges or other services that cooperate (CNBC).
What to watch next
Watch three things: whether Binance reopens withdrawals inside its 48-hour window (FinanceFeeds), whether the 18,270 BTC and the ETH stash start moving toward bridges and OTC desks, which TRM expects as the next stage (TRM Labs), and whether US authorities file the seizure actions that would let Tether and Circle burn and reissue.
Binance has also promised a technical post-mortem and an updated Proof of Reserves (Binance on X). We will update this post as issuers publish freeze breakdowns.
This content is provided for informational and educational purposes only and does not constitute financial, investment, legal or tax advice. Figures in this article come from company statements and on-chain analytics firms as of the morning of 30 October 2026, they were still changing at the time of writing, and the Stablecoin Insider share calculations are simplified estimates, not audited totals. It is not a recommendation to buy or sell any token, and no material herein should be interpreted as an endorsement or solicitation.
