USDT Frozen: We Counted What Tether and Circle Really Blocked in the Binance Hack

Update 10:45 UTC: trail leads to North Korea, withdrawals within 48 hours. Investigators at TRM Labs attribute the Binance hack with high confidence to North Korea's TraderTraitor group, and Chainalysis points to the same group; Binance has not named an attacker. According to TRM Labs, about $6.36 billion left across ten blockchains, about $2.7 billion is frozen, and the attacker holds more than 420,000 ETH and 18,270 BTC across all wallets. Binance expects to reopen withdrawals within 48 hours; deposits work. Everything in one place: North Korea behind the Binance hack? What we know.

Update 02:30 UTC: Binance puts the damage at $6.3 billion. In an official announcement Binance estimates the total impact at around $6.3 billion, of which about $3 billion is frozen on-chain. According to the initial investigation, a DevOps engineer's laptop was compromised, which let the attacker access a service container and submit unauthorized withdrawal transactions. Binance says it has found no evidence of a private key leak. The exchange will cover all losses from the SAFU fund and company funds; deposits and withdrawals remain suspended, and an updated proof of reserves will follow.

Update 01:25 UTC: Binance confirms the hack. Co-founder Yi He wrote at 00:04 UTC that user funds are safe and Binance will cover all hacking losses. Deposits and withdrawals are temporarily suspended while the exchange runs security checks, freezes funds and works with law enforcement. According to on-chain investigator ZachXBT, more than $2.83 billion is now frozen. Before the freezes, the attacker had supplied 60 million USDT to Aave and borrowed 19,762 wETH, about $45 million, against it, as Marc Zeller of the Aave Chan Initiative explains.

User funds are safe. Binance will cover all hacking losses. Deposits and withdrawals are temporarily suspended while our team conducts security checks, freezes funds, and works with law enforcement. We will share a full post-mortem once the investigation is complete. Please rely only on official Binance channels for updates.

Yi He (@heyibinance) October 30, 2026

How much USDT is really frozen in the Binance hack? Counted directly in the Tether and Circle contracts: the attacker address "Binance Hot Wallet Exploiter 2" holds 1,175.5 million USDT and 823.0 million USDC, and both balances are frozen. That is about $2.0 billion the attacker can no longer move. But about 700 million USDT had already been pushed to two new addresses, and those were empty when Tether blacklisted them. Measured on October 29 at about 22:50 UTC.

What happened tonight is in our Binance hack report and our crypto crash timeline.

Advertisement, for readers in the EU: If you no longer want to keep your coins on Binance after the hack, Bitpanda compares itself with Binance, Kraken, Coinbase and Crypto.com and shows a three-step guide to moving your crypto. Bitpanda is licensed in the EU under MiCA. Other MiCA-licensed alternatives in the EU are Coinbase (licensed via Luxembourg) and OKX (licensed via Malta).

Which EU-licensed exchanges are a Binance alternative, what they charge and how to move your crypto is covered in our guide Binance alternatives: 4 MiCA-licensed exchanges compared.

What is really frozen in the Binance hack?

Tether CEO Paolo Ardoino reports more than 1.567 billion USDT frozen, Circle CEO Jeremy Allaire more than 800 million USDC. We queried the contracts' blacklist for every known attacker address:

Source: blacklist and balance functions of the USDT and USDC contracts queried via a public Ethereum node, transactions via Blockscout. The difference to Ardoino's 1.567 billion therefore sits on other addresses that could not be conclusively identified by press time.

The 700 million USDT that left before the freeze

The attacker moved fast. At 20:30 and 20:33 UTC he sent 500 and 200 million USDT to two fresh addresses, about ten minutes after draining the Binance wallet and long before Tether reacted. From there the funds moved on within 25 minutes:

• 175 million and 190 million USDT to two further addresses,
• 145 million USDT into one smart contract and 100 million into another,
• about 10 million USDT swapped directly via Uniswap.

When Tether blacklisted the first two addresses, they were empty. The same pattern showed in the Bitget hack in September, when stablecoins were swapped within minutes and only about $318,000 could be frozen, as Decrypt reported. This time Tether was faster on the bulk.

How can Tether freeze USDT?

USDT and USDC are not coins like Bitcoin but tokens issued by a company. The contract has a blacklist: once Tether adds an address, it can no longer send USDT. Circle has the same power over USDC and says it works with law enforcement:

Circle is closely tracking reports of a potential exploit involving Binance. In coordination with law enforcement, we have frozen more than 800M USDC associated with the incident and will continue supporting the investigation.

Jeremy Allaire (@jerallaire) October 29, 2026

Tether froze more than 1.567B USDT related to a potential Binance exchange hack. Protecting the industry and our partners is our main priority. Stay safe everyone.

Paolo Ardoino (@paoloardoino) October 29, 2026

More on the Binance hack

• Binance hack: how the hot wallet was drained
• On-chain analysis: what the blockchain shows about the hack
• Live ticker and timeline: the crypto crash after the hack
• Binance withdrawals: which networks are paused
• Is this the end? Three scenarios for Bitcoin
• Ethereum: the hacker sits on 195,000 ETH
• Solana below $100: is $80 next?
• BNB crash: another FTT moment?
• The biggest crypto hacks in history
• How to short Bitcoin in the crash
• Why is crypto down today?

Can Tether freeze my USDT?

Technically yes, any address can be blacklisted. In practice it hits addresses linked to theft, fraud or sanctions, usually on a tip from investigators. Holders of USDT from clean sources who do not trade with hacked addresses are generally not affected. That risk is the price of stablecoins having an issuer that can step in, as it did tonight.

What the freeze means for Binance customers

Frozen does not mean returned. The roughly $2 billion is blocked, and Tether and Circle could later reissue it to the victim. Still open are the 700 million USDT that moved on and the 195,460 ETH nobody can freeze. How Binance covers the rest is the key question of the night. The withdrawal status is in our article Binance withdrawals after the hack; devices for self-custody are in our hardware wallet comparison.

This article is not investment advice.