How Circle and Tether Froze Billions From the Binance Hack

Stablecoin issuers froze more than $2 billion of the roughly $6.4 billion stolen from Binance within hours of the October 30 breach.

How an issuer freezes stolen coins

The mechanism is simple to state. USDC and USDT are tokens whose issuers control a blacklist at the contract level: when an address is added to it, any transfer to or from that address is blocked on every wallet and exchange that honors the token. A thief who steals USDC does not hold money in the ordinary sense; they hold a claim that Circle can switch off. That is what happened here. Circle froze approximately $823 million in USDC connected to the attack, and Tether CEO Paolo Ardoino said Tether froze more than 1.567 billion USDT related to what he called a potential Binance exchange hack, though some reports put the Tether figure at $975.1 million, a discrepancy the two accounts have not resolved.

Tether froze more than 1.567B USDT related to a potential Binance exchange hack.

Protecting the industry and our partners is our main priority.

Stay safe everyone.

- Paolo Ardoino (@paoloardoino) October 29, 2026

Together with freezes by other blockchain partners, the issuers immobilized about $2.4 billion of the stolen funds. That is not the same measure as the roughly $3 billion Binance says is frozen on-chain, which includes assets beyond the two big stablecoins. The distinction matters for the recovery math: quick freezing brought the estimated unrecovered losses into the $3 billion to $4 billion range, and security researchers note that without it the majority of funds stolen by state-sponsored groups is never recovered.

The speed is the point. Ardoino's post went up late on October 29, before Binance had published its own detailed account, meaning issuers were blacklisting addresses while the exchange was still confirming what had happened.

The federal probe behind the freezes

The freezing ran alongside a law enforcement response. Binance said in its statement on X that it had engaged law enforcement and blockchain intelligence partners to trace and recover funds, and the FBI and US Secret Service have reportedly joined the investigation. Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions," the exchange said, adding that it found no evidence of any wallet private key leak. Binance's account places the failure in its infrastructure rather than in a smart contract, and we traced how the breach came through a laptop, not a smart contract. The FBI said it is aware of the incident and is working with public and private partners to coordinate investigative steps; the Secret Service has not commented on its role.

Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private... pic.twitter.com/5REncAI77y

- Binance (@binance) October 30, 2026

Blockchain analytics firms TRM Labs, Elliptic and Chainalysis have all attributed the attack to TraderTraitor, a North Korean hacking group previously linked to the $1.5 billion Bybit theft. Neither Binance nor law enforcement has publicly attributed the hack, and the attribution remains theirs alone. Security researchers have also examined how the drain may have happened through delegated wallet permissions.

Binance said it will cover all losses from its SAFU fund and company funds, and that user funds are safe. Deposits and withdrawals remain suspended while security checks continue, with Binance targeting a resumption of withdrawals by Sunday, November 1.

The post How Circle and Tether Froze Billions From the Binance Hack appeared first on Techreport.