Binance hack 2026: who froze the stolen money, from Tether's 1.77 billion USDT to Arbitrum
Binance hack: who froze the stolen billions
TRM Labs counted about $2.7 billion of the 29 October Binance theft frozen by 00:30 UTC on 30 October, most of it by Tether and Circle, with Ripple, World Liberty Financial and the Arbitrum Security Council adding the rest. Binance, Elliptic and on-chain investigators have each published a different total.
Piece published Reviewed by CryptoGuardz Register Desk, editorial desk
By 00:30 UTC on 30 October, about four and a half hours after the Binance theft began, roughly $2.7 billion of it was frozen, according to blockchain analytics firm TRM Labs. Tether froze about 1.77 billion USDT and Circle about 825 million USDC. Three smaller freezes made up the rest. Much of the rest of the money sits in coins no company can freeze.
Who froze what
TRM's count, as of 00:30 UTC on 30 October:
| Who froze | What | When (UTC, 29 to 30 Oct) |
|---|---|---|
| Tether | about 1.77 billion USDT across Ethereum, Tron, Avalanche and Polygon | from 21:01 |
| Circle | about 825 million USDC | from 21:04 |
| Ripple | 40.5 million RLUSD, out of 88.5 million taken | 22:01 |
| World Liberty Financial | 27.8 million USD1 | 22:10 |
| Arbitrum Security Council | 8,426 ETH and 74.6 million ARB, about $30 million | 00:08 |
The first four are stablecoin issuers, which can block a token at an address. The fifth is unusual. ETH cannot normally be frozen, but the Arbitrum network's Security Council used its emergency powers to move assets out of the attacker's wallet on that network. The investigator ZachXBT announced it on X:
BREAKING: Arbitrum Security Council has executed a transaction to freeze ~$30.5M from the Binance Exploit.
Why every total is different
Five sources, six figures, all within about two days:
- Decrypt reported $1.8 billion frozen by Tether and Circle on 29 October.
- Binance posted a verified total of $2.54 billion late on 29 October, and said it was "aware of differing figures circulating publicly".
- TRM counted about $2.7 billion at 00:30 UTC on 30 October.
- ZachXBT posted over $2.83 billion on 30 October, and Binance posted "around $3 billion" the same day.
- Elliptic gave $2.85 billion, about 44% of $6.43 billion, on 31 October and 1 November.
We are aware of differing figures circulating publicly regarding the amount frozen, including references to $1.8 billion. For clarity, the current verified total frozen is $2.54 billion. This figure may continue to increase as our teams work closely with law enforcement,…
The gaps come from timing and method: when each was counted, what each counted as frozen, and how it was valued. Binance's "around $3 billion" came only minutes after TRM's $2.7 billion count, so timing alone does not explain it. Elliptic counts at current prices and includes further freezes by other issuers. The theft totals differ too: about $6.3 billion is Binance's estimate, per Elliptic, against $6.36 billion from TRM and $6.43 billion from Elliptic.
What it changes for users
Two things. First, TRM counted more than 420,000 ETH and 18,270 BTC, about $2.4 billion, beyond any issuer's reach at the time of its count, plus smaller amounts on other chains. Coins such as ETH, SOL and BTC have no freeze function, and that is the money the attacker is now trying to launder, as the on-chain follow-up shows.
Second, the same power that stopped the attacker applies to every holder. Tether and Circle can freeze tokens at any address. Here, Tether froze its first wallet 37 minutes after the main Ethereum sweep at 20:24 UTC, per TRM and Blockscout; the theft itself began at about 20:05 UTC. How and when USDT freezes happen, and what that means for deposits, is covered in the USDT explainer. Binance's own entry is on the register.
Quick answers
How much of the Binance hack was frozen?
About $2.7 billion by 00:30 UTC on 30 October, per TRM Labs. Binance later said around $3 billion, and Elliptic $2.85 billion by 1 November.
Who froze the most?
Tether, with about 1.77 billion USDT, followed by Circle with about 825 million USDC, according to TRM.
Can Tether freeze my USDT?
Tether can freeze USDT at any address, and it froze about 1.77 billion USDT linked to this theft within hours, per TRM.
Sources
- TRM Labs, North Korea steals USD 6.36 billion from Binance, 29 October 2026, data as of 30 October 00:30 UTC, retrieved 1 November 2026
- Binance on X, verified frozen total of $2.54 billion, 29 October 2026, retrieved 1 November 2026
- Binance on X, verified frozen total around $3 billion, 30 October 2026, retrieved 1 November 2026
- ZachXBT on X, Arbitrum Security Council freeze, 30 October 2026, retrieved 1 November 2026
- ZachXBT on X, total frozen over $2.83 billion, 30 October 2026, retrieved 1 November 2026
- Elliptic, The Binance hack is laundering on autopilot, 31 October 2026, retrieved 1 November 2026
- Elliptic, Binance hack analysis, updated 1 November 2026, retrieved 1 November 2026
- Blockscout, sweep transaction from the Binance hot wallet at 20:24 UTC, 29 October 2026, retrieved 1 November 2026
- Decrypt, Tether and Circle freeze $1.8 billion, 29 October 2026, retrieved 1 November 2026
About this piece
Compiled by the CryptoGuardz register team from the sources listed above. Research and drafting are AI-assisted and reviewed by a named editor before publication. Nothing here is a recommendation to gamble. If a figure or a reading is wrong, tell us and the correction is logged in public.