$1 Billion Frozen in 37 Minutes: The $6.3B Binance Hack Puts Stablecoin Freeze Power Under Scrutiny

Late on October 29, attackers emptied Binance hot wallets in about 20 minutes, taking $6.3 billion in the largest crypto heist on record. Thirty-seven minutes later, Tether froze $970 million in USDT. That same day, Tether reported excess reserves nearly doubling to $7.95 billion. Freeze speed and reserve size arrived on stage together, shifting the stablecoin debate from “are reserves enough” to “who holds freeze power, and what constrains it”.

$6.3 Billion Gone in 20 Minutes: The Fall of Signing Infrastructure

At 20:24 UTC on October 29, an attacker drained Binance’s main Ethereum hot wallet, moving 14,167,464 ETH and 63 tokens in one sweep, including about $1.615 billion in USDT. According to TRM Labs, funds flowed from Binance-controlled wallets to attacker addresses across ten blockchains, totaling roughly $6.36 billion, most of it within about 20 minutes. That is roughly four times the $1.5 billion taken from Bybit in February 2025, making it the largest crypto theft on record. TRM Labs attributed the attack with high confidence to TraderTraitor, a hacking unit linked to North Korea; the FBI publicly named the same unit on October 31.

What makes this breach unusual is that the failure was in signing infrastructure, not a single private key. Wallets on multiple chains, using different keys and signing methods, all produced valid signatures for transactions the attacker wanted. TRM concluded that the attacker had taken control of Binance’s own signing system, enabling it to approve arbitrary transactions. On Ethereum, the attacker exploited the account-delegation feature introduced by the recent EIP-7702 upgrade, preparing 50 pre-signed authorizations from a Binance hot wallet and relying on the nonce batching mechanism to ensure one would be valid on submission, then taking over the wallet and sweeping its funds. Binance’s initial investigation pointed to a compromised DevOps engineer’s laptop; co-CEO Richard Teng later revised the account, describing a complex attack involving malware designed to erase traces, rather than the misuse of a single engineer’s permissions.

Binance suspended withdrawals and launched the largest asset-remediation effort on record. By October 31 it had replenished 90 to 95 percent of the stolen assets (about $6 billion), drawing on its $1 billion Secure Asset Fund for Users (SAFU), part of its Futures Insurance Fund and corporate treasury, with 50 percent of SAFU deployed and a commitment to refill it to about $1 billion. Withdrawals resumed in phases from 6:00 UTC on November 1, with the first wave covering 15 networks including BTC, ETH, BNB, SOL, XRP, DOGE, TRON, AVAX and stablecoins USDT and USDC. Binance has pledged to absorb the full financial impact and plans to publish a technical report once its investigation concludes. In markets, Bitcoin briefly fell below $79,000 on October 29 and traded at $77,315 on October 31, below its 50-day average of $81,893; Coinbase shares slid from $183.81 to $143.54 in two weeks, and Moody’s warned that the concentration risk of hot wallets had been exposed again.

The 37-Minute Freeze Race: Stablecoins Act as Law-Enforcement Tools for the First Time

The most striking part of this heist is not the amount stolen, but the speed of recovery. Stablecoin issuers exercised freeze powers collectively at scale for the first time, measured in minutes.

Tether froze about $1.77 billion in USDT in total (including later expansions), Circle about $825 million in USDC; with Ripple’s RLUSD, World Liberty’s USD1 and the Arbitrum Security Council’s emergency transfers, Binance said roughly $3 billion had been brought under control. But a freeze is not a refund. TRM Labs’ head of policy Ari Redbord told CNBC: “A freeze stops the money from moving, and recovery follows through legal process.” Chainalysis’ Eric Jardine added that returning funds “can take months or years.” The attacker had already started converting before the freezes arrived: about $325 million in USDT was sold to professional market makers through UniswapX at a discount of more than 10 percent for ETH, USDT was pledged on Aave to borrow about 19,760 ETH, and a “peel chain” technique was used to split the stolen BTC into small tranches. TRM estimates that about $2.4 billion has become ETH and BTC, beyond the reach of any issuer’s freeze list.

Speed is not the most intriguing part of this episode, timing is. When Tether acted at 21:01, no institution had publicly attributed the attack to North Korea; TRM’s attribution analysis came hours later. No court order could have been obtained within the hour, Tether did not disclose receiving a law-enforcement request, and Circle said it coordinated with law enforcement but identified no order. On the public record, close to $1 billion was frozen before any court had ruled on ownership, supported only by evidence that a theft was in progress and, possibly, unpublicized informal official contacts. That is the core question the EFRI briefing raised: an intervention capability of this power has now been demonstrated at scale, with no published trigger standard.

Who Can Trigger a Freeze: Gaps and Fault Lines in the Regulatory Framework

Issuers do not behave consistently, and the inconsistency had already surfaced in another incident a year earlier. In the April 1, 2026 Drift Protocol exploit, Circle declined to freeze the stolen USDC, with CEO Jeremy Allaire saying at the time that Circle only freezes assets at the direction of law enforcement or courts, and that unilateral intervention would constitute “a significant moral quandary.” In the Binance case, Circle froze $820 million in USDC 40 minutes after the attack. The same company, two modes of behavior, separated by a much larger heist and explicit law-enforcement coordination. New York Attorney General Letitia James and four district attorneys wrote to senators in January noting that Tether would freeze, destroy and reissue USDT at law-enforcement request but does not acknowledge a legal obligation to do so; Circle acts only on signed court orders or search warrants.

The regulatory texts leave the same gap. Section 4(a)(6)(B) of the US GENIUS Act requires issuers to have the technical capability to comply with lawful orders, where “lawful order” is defined as a final court or agency order naming specific stablecoins; Section 4(a)(5) directs the Treasury to establish procedures for blocking, freezing and rejecting unlawful transactions. But the Congressional Research Service notes that the Act does not specify whether issuers should act proactively or only on lawful orders; “who can trigger preservation” is left open. On the EU side, Articles 48, 49 and 55 of MiCA have no equivalent to the GENIUS capability rule, and Article 94(3) only allows supervisors to request freezes for market-abuse tasks; Directive (EU) 2024/1260 (asset recovery and confiscation) Article 11 allows member states to take immediate preservation measures before a freezing order, with asset recovery offices able to act for up to 7 days, transposition due November 23, 2026. But the Directive operates through national bodies, leaving victims no direct channel to issuers, and whether an asset recovery office can reach a foreign issuer’s token contract within hours has not been tested.

$7.95 Billion in Excess Reserves: Tether Delivers Its Strongest Report on the Same Day

On October 30, the day after the heist, Tether published its Q3 attestation prepared by BDO: total reserve assets of $191.5 billion against liabilities of $183.5 billion, leaving $7.95 billion in excess reserves, nearly double the $4.1 billion at the end of June; third-quarter net operating profit of $1.5 billion, bringing the first nine months of 2026 to $4.5 billion. Direct and indirect holdings of US Treasury bills totaled $132.4 billion with a weighted average maturity below 90 days, a footprint comparable to South Korea’s $134.2 billion in US government debt and above the UAE’s $116.1 billion. The portfolio also included $19.08 billion in physical gold, $8.37 billion in directly held Bitcoin (valued at $83,621.23 on September 30), $14.18 billion in secured loans and $4.18 billion in public equities. CEO Paolo Ardoino tied profitability and the growing cushion to keeping USDT dependable under market stress, and noted that USDT’s user base had surpassed 700 million.

The attestation and the freeze action surfaced on the same day, making a telling comparison. Roughly half of the increase in excess reserves came from valuation gains on the Bitcoin position, which rose from $5.8 billion to $8.4 billion, with about $2.6 billion of that from price appreciation rather than new inflows. The most liquid reserve category actually shrank: cash, cash equivalents and short-term deposits fell from $140.6 billion to $139.58 billion, with the share of total reserves dropping from 74.9 percent to 72.9 percent, as overnight reverse repos fell from $18.6 billion to $9.5 billion while directly held T-bills rose from $115.0 billion to $122.8 billion. In other words, the buffer grew while the most liquid portion of it declined in share, and Bitcoin and gold occupy a larger share of reserves.

The boundaries of the attestation matter as much as the headline. A BDO attestation is a point-in-time assessment, not a full audit; the report states valuations assume normal market conditions and may not reflect realizable value during extraordinary disruptions or counterparty illiquidity. Tether completed its first full independent financial-statement audit by KPMG US in August, but the audited statements were not made public. The report also lists one pending lawsuit, a New York class action tied to Bitcoin’s 2017 and 2018 price decline, for which no provision has been recognized and whose outcome management says cannot yet be reliably estimated. The fastest large-scale freeze in history and a balance sheet that has not yet been fully audited arrived on the same stage; together they make the complete picture of this event.

Implications for Practitioners