Table of Contents
The largest crypto theft on record gave stablecoin issuers their biggest live test yet.
Issuers showed they can stop the money. They haven’t shown who else gets that protection.
Binance says it has now covered 95% of the stolen assets, and it reopened withdrawals on Sunday, recording $3.64 billion of net outflows, or 2.1% of total assets. The FBI has also formally attributed the theft to North Korea’s TraderTraitor group.
The exchange story is calming down, but the stablecoin story is just starting. We covered the mechanics in last week’s breakdown. This issue looks at what institutions should do with the result.
Who Was Able to Freeze Funds?
| Asset | Taken | Frozen | Share frozen | First freeze (UTC) |
|---|---|---|---|---|
| USDC | 823M | ~825M | ~100% | 21:04 |
| USDT | 2.49B | ~1.77B | ~71% | 21:01 |
| RLUSD | 88.5M | 40.5M | ~46% | 22:01 |
| BTC | 18,270 (~$1.47B) | None | 0% | n/a |
| XRP | 233.46M (~$296M) | None | 0% | n/a |
| SOL | 970,500 (~$96M) | None | 0% | n/a |
Frozen and taken figures are TRM Labs’ 30 October on-chain counts; share frozen is our calculation.
Across USDT, USDC and RLUSD, issuers locked about 78% of what was stolen. That’s the strongest real-world case yet for issuer controls.
Where the switch fell short
The headline hides four problems:
- Attackers can outrun a freeze. Elliptic counts $786 million converted before freezes landed, while Bitquery counts $729 million of USDT. The attacker paid discounts above 10% to get out, which shows how much a freezable asset was worth discounting.
- Wallet structure mattered as much as speed. Circle caught its full amount in one wallet before it moved, while USDT was already spreading across fresh wallets, and six of Tether’s 11 freezes hit empty addresses.
- The totals still don’t reconcile. Reported frozen totals run from about $2.7 billion at TRM to $2.84 billion at Elliptic and roughly $3 billion at Binance. Ripple’s reported $200 million compares with 40.5 million RLUSD that TRM could confirm.
- Most of what wasn’t frozen can’t be. TRM estimates the attacker still holds about $2.4 billion in BTC and ETH.
The double standard
This is the uncomfortable part. Tether’s first freeze came 37 minutes after the main Ethereum sweep, before any public attribution and too soon for a court order.
In April, Allaire said Circle freezes USDC only at the direction of law enforcement or a court. After the Drift exploit that month, Circle declined to freeze stolen USDC as it moved across chains for hours. This time, Circle said it acted in coordination with law enforcement, but it hasn’t identified any order.
Forte’s Anton Golub supported the freezes but put the objection plainly: “The rules should be the same for everyone.”
The law doesn’t settle this yet. GENIUS requires issuers to be technically able to comply with lawful orders, but doesn’t say whether they should act on their own initiative or only after an order. The Act takes effect on January 18, and the Treasury’s AML and sanctions rulemaking is still at the proposal stage.
Frozen isn’t recovered
Returning funds typically needs a court order or seizure warrant, and Chainalysis’ Eric Jardine says the process has no standard timeline and can take months or years. We found no public seizure action in this case so far.
For a sense of pace, in one Ohio case Tether froze about $200,000 in March 2024, a seizure warrant followed that July, and the forfeiture complaint came that October.
Five questions for your issuers and vendors
- What triggers a freeze? Ask for the written policy, including whether the issuer will act before a court order.
- Who do we call at 2 a.m.? Binance had a direct line as the first partner in T3+, a program of the Tether-backed T3 Financial Crime Unit. If you don’t have an equivalent, build one now.
- What happens if we’re frozen by mistake? Conduit Technology is suing over $2.76 million in USDT it says has been frozen since September 2025. Ask about the appeal path and how long it takes.
- Can our screening keep up? Stolen stablecoins moved through DEXs and market makers within hours. Check how quickly your counterparties can act on a new blacklist.
- Will the issuer publish what it froze? Ask for addresses and amounts, not a round number on X.
Our bottom line
Freezability is now a measurable feature, and this hack put numbers on it. For institutions, the difference between 100% and 0% recovery potential came down to the asset. But the same control that protected Binance can also lock out a legitimate holder, on a standard no one has fully written down.
Judge issuers on their process, not only on their speed.
Read Next:
