Half of the Binance hack could be frozen. The other half had no one to call.

At 20:24 UTC on Thursday 29 October, one Ethereum transaction moved 167,464 ether and 1.615 billion USDT out of a Binance hot wallet to a brand new address. On-chain trackers first put the total that left Binance at between $5.57 billion and $5.9 billion. At 02:23 UTC on Friday, Binance gave its own estimate: "around $6.3B", with about $3 billion frozen on-chain so far. Nearly all of the frozen money is stablecoins, because Tether, Circle and Ripple can block an address. Bitcoin and ether have nobody who can. That split is the part of the Binance hack I want to understand.

Was Binance hacked, and how much is frozen?

Binance first called it a "potential security issue". Its co-founder Yi He then wrote on X that "Binance will cover all hacking losses", and by 00:07 UTC on 30 October the exchange had suspended deposits as well as withdrawals. In a security update on Friday morning, Binance said its initial investigation points to a compromised DevOps engineer's laptop, which let the attacker into a service container to submit unauthorized withdrawals. It says it found no evidence of a private key leak and will cover all losses from its SAFU fund and its own money. The estimates of what left differ by who is counting. Decrypt's on-chain tally came to at least $5.57 billion: $3.51 billion on Ethereum, $1.44 billion in 18,270 bitcoin and $630 million on Tron. Chainalysis put it at $5.912 billion, and Bitcoin.com News listed a Glassnode figure of $5.3 billion. Those were all outside estimates. Binance's own figure, about $6.3 billion, came later and is still called an initial estimate until its post-mortem.

The freezes came fast. Circle froze 823 million USDC in the main receiving wallet at 21:04 UTC, forty minutes after the first transfer. Its chief executive, Jeremy Allaire, wrote: "In coordination with law enforcement, we have frozen more than 800M USDC associated with the incident". Reuters reported Tether froze nearly $1.57 billion of USDT. Yi He said Ripple froze about $200 million. World Liberty Financial froze $27 million of USD1, and the Arbitrum Security Council froze $30.5 million. Binance's own verified total was $2.54 billion at 23:35 UTC and $3 billion at 00:52 UTC, and it still said about $3 billion in its 02:23 UTC update.

My first reaction: crypto has no undo button

That's the line everyone repeats, and I believed it when I saw the headline. Then I read the freeze list again. Half of this hack got an undo button, or at least a pause button. Circle's own USDC terms say it can block addresses and freeze USDC "temporarily or permanently" when it decides activity is linked to illegal conduct. Tether can do the same with USDT. The ether and bitcoin had no issuer to ask.

The comparison that made it click is Bybit. On 21 February 2025 an attacker took control of Bybit's Ethereum wallet and $1.5 billion with it. Euronews reported that platforms froze a little over $42.89 million, which is under 3%. Binance's frozen share is just under half: about $3 billion of its own $6.3 billion estimate. I don't think investigators got that much better in twenty months. I think the Binance wallet just held a lot of stablecoins, and stablecoins come with someone who can say no.

The second check cut the other way. Frozen isn't the same as returned. FinanceFeeds explains that blacklisted stablecoins sit where they are until the issuer reissues or burns them, usually after law enforcement or a court confirms who owns them, and that can take weeks. So "$3 billion frozen" means "$3 billion the thief can't spend", which is good, but it isn't yet money back in Binance's accounts.

Where else did an intermediary stop a theft?

The cross I keep coming back to is the Bangladesh Bank heist. On Thursday 4 February 2016, starting at about 9:55 a.m. New York time, the Federal Reserve Bank of New York received 35 payment orders from Bangladesh Bank's account worth about $951 million. They were fake. Reuters later reconstructed what happened. The Fed paid five of them, $101 million in total. The other 30 stopped mainly because one payment address contained the word "Jupiter", which matched a tanker and shipping company under US sanctions. Reuters called that "a stroke of luck". Of the five that went through, $20 million to Sri Lanka was reversed because of a spelling mistake. The $81 million that went to the Philippines is the money the US Justice Department later said "the Conspiracy stole".

So about 89% of the attempt was stopped, and almost none of that was by design. The Fed did query Bangladesh Bank that Thursday, but nobody in Dhaka was available to answer. The attack had been timed for the Bangladeshi weekend, and the attackers had disabled the bank's printer and its SWIFT software.

The mechanism is the same in both cases. Money stopped where it passed through someone with the authority and a reason to refuse. In 2016 that was the Fed's sanctions screening, triggered by accident. In 2026 it was the stablecoin issuers, acting on purpose and within the hour. Where nobody stood in the path, the money went: into accounts in the Philippines then, into native bitcoin and ether now.

Bitcoin and ether aren't completely beyond reach. If the thief sends them to an exchange, that exchange can freeze the deposit. Bybit's $42.89 million was frozen that way, by platforms and brokerages, not by an issuer. But that only works if the thief walks through someone's door. With a stablecoin, the door is built into the token.

What does this mean if you hold crypto?

The switch works both ways, and I think people should be honest about that. The same power that may have saved half of the Binance loot can freeze your USDC if Circle decides your address is linked to illegal conduct. A stablecoin is a claim on a company, and a company has a phone number that police can call. My own view, and it's only my view: for an exchange's hot wallet, an issuer with an off switch is a feature, and for someone who chose bitcoin to avoid exactly that, it's the price they didn't want to pay. I wrote earlier about what makes a stablecoin's par believable, and the same theme is here: the trust comes from an institution standing behind the token, and that institution can also act against you.

The other lesson is about where the risk sits. Security reviews tend to ask whether keys are safe. After this week I'd also ask what share of a hot wallet is in assets nobody can freeze, because that share is the part you lose for good. A similar gap between "genuine" and "safe" came up in the Ledger reseller case.

What would change my mind: Binance's promised post-mortem showing the stablecoin share was much smaller than it looks today, or large amounts of the bitcoin and ether being frozen downstream at other exchanges. Either would make the split less clean.

How sure am I?

More on Daily Ferment: Korean banks had permission to test with AI. The attacker just had the tool. and Stablecoin FX went below interbank. The cost moved into routing.

Sources

• Binance, "Security Incident Update", Binance Support, 30 October 2026 (also posted on X by @binance). binance.com
• Jose Antonio Lanz, "Binance Drained of $5.5 Billion in Suspected Hack, Tether and Circle Freeze $1.8 Billion", Decrypt, 29 October 2026. decrypt.co
• Vallari Srivastava, "Tether, Circle freeze $2.38 billion" (Binance says $2.54 billion in assets frozen), Reuters via Yahoo Finance, 29 October 2026. finance.yahoo.com
• Cointelegraph, "Live updates: Binance says $3B in crypto frozen in connection to hack", via TradingView, 29 to 30 October 2026. tradingview.com
• FinanceFeeds, "Binance Hack: $3B Now Frozen as Recovery Nears Losses", 30 October 2026. financefeeds.com
• Jamie Redman, "Inside the $5.8B Binance Hack: What's Confirmed and What Isn't", Bitcoin.com News, 29 October 2026. news.bitcoin.com
• Circle, "USDC risk factors", last updated 27 October 2023. circle.com
• Euronews, "Crypto platform Bybit closes $1.5 billion gap following 'largest crypto heist of all time'", 25 February 2025. euronews.com
• Reuters, "How the New York Fed fumbled over the Bangladesh Bank heist", 21 July 2016, via Business Insurance. businessinsurance.com
• US Department of Justice, "North Korean Regime-Backed Programmer Charged With Conspiracy to Conduct Multiple Cyber Attacks and Intrusions", 6 September 2018. justice.gov