The $6.3 Billion Binance Hack: Inside the Record Stablecoin Freeze Response
On October 29, attackers drained roughly $6.3 billion from Binance, the largest crypto theft on record. Within hours, stablecoin issuers froze close to $3 billion of it. Here is the freeze response and what it means.
On October 29, 2026, attackers drained roughly $6.3 billion from Binance hot wallets across nine chains - the largest crypto theft on record, more than four times the $1.5 billion Bybit hack of February 2025. Within hours, stablecoin issuers and protocol operators had frozen close to $3 billion of it. This is the freeze response, and why it is the story that matters most for anyone tracking on-chain enforcement.
How the funds left
The attacker spent a day in preparation. On October 28 a fresh wallet (0x7c86…) was funded with three small Tornado Cash withdrawals and, the next day, deployed a "sweeper" contract. At 20:20 UTC on October 29, that wallet sent a single EIP-7702 transaction to Binance's busiest hot wallet, carrying 50 pre-signed authorizations so one would match the wallet's live nonce. One did - and from that moment the hot wallet was delegated to the attacker's code.
Three minutes and twenty-four seconds later the sweeper emptied the wallet: 167,464 ETH and 63 different tokens, including 1.6 billion USDT, in one transaction. Because the EIP-7702 delegation stayed active, the attacker swept new deposits repeatedly over the next several hours until Binance revoked it around 00:10 UTC on October 30. Binance says the breach may trace to a compromised engineer's laptop rather than a leaked key, has suspended withdrawals, and has pledged to cover all losses. Elliptic attributes the theft to North Korea-linked actors with medium-to-high confidence; no attribution has been officially confirmed.
The freeze response: ~$3 billion, mostly stablecoins
This is where issuers' freeze powers met the largest theft in history. The response was fast: Tether froze the attacker's main Ethereum wallet roughly 37 minutes after the stolen funds landed in it, and Circle followed about three minutes later. By October 30, independent trackers put the frozen total at $2.8-3 billion - and rising as freezes are confirmed. Elliptic verified $2.84 billion frozen, about 44% of the theft, of which 94% is stablecoins.
What has been frozen so far (figures as of October 30, and still climbing):
Tether (USDT) - more than $1.5 billion frozen on the main attacker wallet, then several more addresses within minutes. Bitquery puts Tether's total near 1.76 billion USDT, around 71% of the USDT taken.
Circle (USDC) - 823 million USDC, frozen on the same Ethereum collection wallet minutes after Tether.
Ripple (RLUSD) - roughly $200 million in stablecoins.
World Liberty Financial (USD1) - about $27 million.
Arbitrum Security Council - ~$30.5 million moved into a locked wallet (74,559,805 ARB + 8,425 ETH) - a chain-governance freeze rather than an issuer one.
Others (Paxos, First Digital and more) - roughly $350 million combined.
Two details underline how these controls actually behave under pressure. First, Aave froze its V3 and V4 lending markets after the attacker parked USDT as collateral and borrowed WETH against it - a protocol-level freeze layered on top of the issuer freezes. Second, about 204 million USDT that was sent into the already-frozen main wallet after the freeze is now locked there too: once an address is frozen, funds routed to it are trapped.
What can't be frozen
Freezes only reach assets whose issuer holds that power. Roughly $3.3 billion of the stolen value sits in assets no one can freeze - about 511,861 ETH, 18,270 BTC, and 233 million XRP - which is why the attacker rushed to swap stablecoins into ETH (paying ~15% above market to do it quickly) before the freezes landed. That split, frozen stablecoins on one side and unfreezable native assets on the other, is the clearest illustration yet of where centralized stablecoin controls end.
Tracking it on blocklist.fyi
Every issuer freeze above - each USDT, USDC and USD1 blacklisting across Ethereum, Tron, Arbitrum and the rest - is exactly what blocklist.fyi records in real time. You can watch the freezes as they are confirmed on the live blacklistings feed, and the attacker's main Ethereum collection wallet, where Tether and Circle froze the largest single amounts, has its full freeze history on its address page.
Frozen balances are the starting point for recovery, not the end of it - but a freeze that lands 37 minutes after a theft, at this scale, is a measurable sign that on-chain enforcement has matured. We will keep tracking the freezes as issuers confirm more of them.