Source publication time: November 6, 2026, at 22:30 (UTC+8). This summary reflects the reporting and status described at that time.
Stablecoin freezes can prevent tokens from being transferred, but they do not by themselves return funds to a theft victim. That distinction is central to an Odaily report by Wenser, republished by PANews, describing the response to a reported roughly $6.3 billion theft from Binance on October 30.
The article attributed more than $2.3 billion of approximately $3 billion in frozen assets to actions by Tether and Circle. It also described interventions by other issuers, investigators, blockchain security teams, layer-2 networks, lending protocols and exchanges. The figures below are those reported by the source, rather than independently verified totals.
Tether and Circle accounted for the largest freezes
Tether: CEO Paolo Ardoino said the issuer assisted in freezing more than 1.567 billion USDT potentially linked to the Binance theft. According to media reports cited in the article, Tether froze approximately 1.18 billion USDT about 37 minutes after stolen USDT reached the attacker’s main Ethereum wallet, then froze four additional attacker addresses within the next 17 minutes.
The article emphasized that blocking USDT transfers did not mean Binance had recovered the corresponding funds. Further procedures were still required.
Circle: The report put Circle’s freeze at approximately $823 million. CEO Jeremy Allaire had publicly said that more than $800 million in USDC linked to the incident had been frozen and that Circle was coordinating with law enforcement. The article described Circle’s response as coming three minutes after Tether’s.
According to the report, USDT and USDC represented approximately 94% of the stolen stablecoin assets, almost entirely on Ethereum and Tron.
Other issuers also intervened
Binance co-founder and co-CEO He Yi said World Liberty Financial froze approximately $27 million in USD1 and another $2 million worth of WLFI. WLFI co-founder Zach Witkoff confirmed freeze measures and said the project would work with BitGo on the stolen tokens.
The article also reported assistance with relevant stablecoin freezes from Ripple, for RLUSD, as well as Paxos and First Digital, without supplying individual amounts.
Investigators reported different recovery snapshots
The source said the FBI’s cybercrime division issued an October 31 notice attributing the theft of more than $6 billion in virtual assets to North Korean actors associated with TraderTraitor. It described more than 600 Ethereum addresses, nearly 20 Bitcoin addresses and one Solana address linked to the attackers.
The FBI, Secret Service and IRS Criminal Investigation called on infrastructure providers, DeFi services, analytics firms and virtual asset service providers to block transactions associated with those addresses or their derivatives, according to the article.
Blockchain analytics firms supplied tracing and attribution work:
- Elliptic estimated losses at approximately $6.43 billion and verified roughly $2.85 billion as frozen or seized.
- Chainalysis reported approximately $2.8 billion frozen as of November 3 at about 11:30 a.m. ET, and warned that attackers were using thousands of addresses.
- TRM Labs attributed the activity to TraderTraitor with high confidence.
- SlowMist founder Yu Xian said the attackers used EIP-7702 to steal hot-wallet tokens in batches after hours of rehearsal.
These figures reflect separate estimates and reporting times; they should not be added together.
Asset transfers and lending restrictions were different tools
On October 30, Arbitrum’s Security Council moved approximately 8,426 ETH and 74.56 million ARB, together valued at about $30.5 million, from attacker addresses to an intermediate frozen address. Further movement required Security Council action or an Arbitrum DAO governance vote, the report said.
On Optimism, approximately 44 million OP, worth around $5 million, were also moved out of attacker control through governance-side action. Binance had submitted governance proposals seeking the assets’ return; the process could take weeks.
Aave’s intervention was different. The article said attackers deposited approximately 60 million USDT into Ethereum Aave V3 and borrowed roughly 19,762 WETH, then worth $44.6 million. Aave subsequently froze hundreds of DAO-operated market reserves across V3 and V4, stopping new deposits and borrowing while permitting withdrawals, repayments and liquidations.
Founder Stani Kulechov said the contracts were unaffected and the position remained overcollateralized. The restrictions limited further protocol use; they did not recover the ETH already borrowed.
Freezing remained distinct from recovery
The report also described exchange assistance, including Coinbase’s efforts to block transfers to compromised wallets, Bybit’s offer of support and OKX’s call for coordinated security standards.
Its central unresolved question was whether assets that remained unfrozen could be intercepted at OTC channels, mixing services or exchange exits—and ultimately recovered. Frozen balances, assets moved out of attacker control and funds returned to Binance were distinct outcomes.
Original article on PANews, credited to Odaily and author Wenser