Original report published November 6, 2026, at 22:04:18 UTC+08:00.
Stablecoin issuer freezes accounted for most of the $2.85 billion frozen or seized after the October 29 Binance theft, according to blockchain analytics firm Elliptic. Issuers including Tether and Circle froze the affected stablecoins within an hour of the theft, the firm said in a report updated November 6.
The frozen or seized funds represented 44% of the $6.43 billion stolen. That compares with around 3% frozen after the $1.5 billion Bybit hack in February 2025, according to Elliptic.
What the issuer freezes did—and did not—cover
Elliptic’s figures distinguish funds immobilized largely through stablecoin issuers from assets that remained in theft-linked addresses. The $2.85 billion total includes both frozen and seized assets; it is not a figure solely for stablecoin freezes, nor does the report establish that those funds had been returned to Binance.
About $3.11 billion remained in addresses linked to the theft, mostly in ETH and Bitcoin. Elliptic said those funds were “very likely” still held by North Korea. The FBI attributed the theft to North Korean hackers it calls TraderTraitor; North Korea denied involvement.
The remaining holdings illustrate the limits of the stablecoin freezes in this case. The 18,270 BTC stolen from Binance—worth about $1.5 billion at the time—was split among 19 addresses on the day of the theft and had not moved since. The nine largest Ethereum addresses, holding 89% of the attacker’s ETH, had not moved since October 30.
Other assets were being converted
Outside the frozen holdings, Elliptic described a complex, automated laundering operation involving swaps, bridges and mixing services. About $124 million in stolen assets had been converted into Bitcoin, much of it through THORChain.
Elliptic expected the attacker to swap the remaining ETH for Bitcoin and cash out through over-the-counter brokers and exchanges over several months. That was the firm’s forecast, not a confirmed outcome.
Binance’s exchange backing statement was separate
On November 6, Binance said users could verify that their balances were backed at least 1:1 using a zero-knowledge proof for its latest exchange proof-of-reserves snapshot. It also said it aimed to reopen withdrawals for all tokens on restored networks by the end of the following week.
That statement concerned Binance’s backing of customer balances. It was separate from the stablecoin issuer freezes and did not describe Tether’s or Circle’s reserves.