Independent record. Not associated with, endorsed by or operated by Binance. This site is read-only: there is nothing to sign in to, pay for or connect.

The Binance Hack

An independent record of the October 2026 Binance hack

Attack reconstruction: Freezes

Back to the overview · Previous stage: Per-chain draining · Next stage: Consolidation

The claims placed under one stage of the attack, each with its source. The quote, the capture time and the hash of the stored copy are on the statement page that each line links to. Which stage a claim sits under is chosen by keywords in its one-line summary, so it is a reading aid and not a finding.

65 approved claims under this stage.

Freezes

Freezes, blacklists and emergency moves by issuers and network bodies, with the time each source gives.

  1. Reported freeze

    Hacken reports that between $2.7B and $2.84B was frozen within hours of the attack, mostly stablecoins.

    Hacken. Original Statement 13 Captured .

  2. Reported freeze

    Blockaid said that about $3B was frozen within hours, while most of the ETH and other native assets stayed with the attacker.

    blockaid.io. Original Statement 90 Captured .

  3. Reported freeze

    BleepingComputer reported that stablecoin issuers Tether and Circle froze more than $2.3 billion in assets associated with the incident.

    BleepingComputer, BleepingComputer. Original Statement 706 Captured .

  4. Reported freeze

    Elliptic said the stolen USDT reached the attacker's main Ethereum wallet at 20:24 UTC, that Tether froze that wallet 37 minutes later locking 1.18 billion USDT, and that Circle froze the 823 million USDC in the same wallet three minutes after that.

    Elliptic, Elliptic. Original Statement 92 Captured .

  5. Reported amount

    Halborn said that at 20:41:23 the operator moved 780 million USDC to the hub via Hot Wallet 34, and that another 43 million followed at 20:59:47, together making up the 823 million USDC that Circle froze.

    Halborn. Original Statement 978 Captured .

  6. Reported freeze

    Hacken said that Tether froze 971.1M USDT at 21:01 UTC, 37 minutes after the Ethereum transaction.

    Tether, Hacken. Original Statement 19 Captured .

  7. Reported freeze

    TRM said Tether froze 971.1 million USDT in the main receiving wallet at 21:01 UTC, 37 minutes after the main sweep, and that later sweeps landed in that frozen wallet, which then held 1.175 billion USDT.

    Timeline row: TRM said Tether froze 971.1M USDT in the main receiving wallet, 37 minutes after the main sweep

    TRM Labs, TRM Labs. Original Statement 143 Captured .

  8. Reported freeze

    Halborn's freeze table listed Tether freezing 971.1 million USDT on Ethereum at 21:01:35 UTC, 37 minutes after the sweep, rising to about 1.18 billion by later reads as sweeps kept landing in the frozen hub.

    Halborn. Original Statement 987 Captured .

  9. Reported freeze

    Hacken said that Circle froze 823M USDC at 21:04 UTC.

    Circle, Hacken. Original Statement 20 Captured .

  10. Reported freeze

    TRM said Circle froze the 823 million USDC in the main receiving wallet at 21:04 UTC, in coordination with law enforcement.

    Timeline row: TRM said Circle froze 823M USDC in the main receiving wallet

    TRM Labs, TRM Labs. Original Statement 144 Captured .

  11. Reported freeze

    Decrypt reported that Tether froze 975.1 million USDT in the main receiving address and Circle froze 823 million USDC in the same wallet at 21:04 UTC, bringing the total frozen to about $1.8 billion.

    Decrypt. Original Statement 694 Captured .

  12. Reported freeze

    Hacken said that another count dates the first freezes at 21:14.

    Timeline row: Hacken noted another count dates the first freezes at 21:14, against 21:01 in its own table

    Hacken. Original Statement 153 Captured .

  13. Reported freeze

    Chainalysis said freezes started by 5:14 p.m. Eastern.

    Timeline row: Chainalysis said freezes started by 5:14 p.m. Eastern; TRM and Hacken list Tether's first freeze at 21:01

    Chainalysis, Chainalysis. Original Statement 191 Captured .

  14. Reported freeze

    Chainalysis said stablecoin issuers began freezing funds by 5:14 p.m. ET on 29 October.

    Chainalysis, Chainalysis. Original Statement 299 Captured .

  15. Reported freeze

    Cointelegraph reported that Changpeng Zhao said the activity appeared to be a hack and that Tether and Circle had frozen approximately $971 million and $823 million respectively.

    Changpeng Zhao, Cointelegraph. Original Statement 114 Captured .

  16. Reported freeze

    Cointelegraph reported that Tether CEO Paolo Ardoino said Tether had frozen more than $1.567 billion in USDT linked to the potential exploit.

    Paolo Ardoino, Cointelegraph. Original Statement 116 Captured .

  17. Reported freeze

    TRM said Ripple froze the wallet holding the stolen RLUSD at 22:01 UTC, with 40.5 million of the 88.5 million RLUSD still inside.

    Timeline row: TRM said Ripple froze the wallet holding the stolen RLUSD, with 40.5M of 88.5M RLUSD still inside

    TRM Labs, TRM Labs. Original Statement 145 Captured .

  18. Reported freeze

    Hacken's timeline table lists Ripple freezing 40.5M RLUSD at 22:01 UTC, citing TRM.

    Hacken. Original Statement 154 Captured .

  19. Reported freeze

    Halborn said Tether blacklisted Binance 14 itself at 22:06.

    Timeline row: Halborn said Tether blacklisted Binance 14 itself at 22:06

    Halborn. Original Statement 766 Captured .

  20. Reported freeze

    Halborn said Tether blacklisted Binance 14 at 22:06, Ripple and World Liberty froze RLUSD and USD1 in the hot wallet by 22:26, and Circle froze Binance's compromised wallets from 23:53.

    Halborn. Original Statement 979 Captured .

  21. Reported freeze

    TRM said World Liberty Financial froze the 27.8 million USD1 in the main receiving wallet at 22:10 UTC, and froze USD1 in the compromised Binance hot wallet at 22:26 UTC.

    Timeline row: TRM said World Liberty Financial froze 27.8M USD1 in the main receiving wallet

    TRM Labs, TRM Labs. Original Statement 146 Captured .

  22. Reported freeze

    Hacken's timeline table lists World Liberty Financial freezing 27.8M USD1 at 22:10 UTC, citing TRM.

    Hacken. Original Statement 155 Captured .

  23. Reported freeze

    Cointelegraph reported that Aave froze markets across its V3 and V4 deployments as a precaution following the Binance hack.

    Cointelegraph. Original Statement 118 Captured .

  24. Reported freeze

    Cointelegraph reported that LlamaRisk said the exploiter deposited 60 million USDT into Aave and borrowed 19,762 WETH worth about $44.6 million at the time.

    Cointelegraph. Original Statement 409 Captured .

  25. Reported freeze

    Cointelegraph reported that, according to Yi He, World Liberty Financial froze $27 million in USD1 and $2 million of WLFI, and that World Liberty Financial co-founder and CEO Zach Witkoff said USD1 had frozen the $27 million associated with the hack.

    Cointelegraph. Original Statement 119 Captured .

  26. Reported freeze

    Hacken said that Binance stated the verified frozen total was $2.54B at 23:35 UTC.

    Binance, Hacken. Original Statement 21 Captured .

  27. Reported freeze

    Cointelegraph reported that Binance said the verified total of assets frozen had reached $2.54 billion, and that Binance said this clarified differing figures in circulation, including references to $1.8 billion.

    Binance, Cointelegraph. Original Statement 120 Captured .

  28. Reported freeze

    TRM said Binance stated at 23:35 UTC that the verified total frozen had reached USD 2.54 billion.

    Timeline row: TRM said Binance stated the verified frozen total had reached $2.54B (Hacken and Cointelegraph give the same time)

    TRM Labs, TRM Labs. Original Statement 147 Captured .

  29. Reported freeze

    Cointelegraph reported that, according to Ripple's Jack McDonald, Ripple was freezing RLUSD linked to the Binance hack and coordinating with relevant parties, without disclosing an amount.

    Jack McDonald, Cointelegraph. Original Statement 121 Captured .

  30. Reported freeze

    Binance stated that customer funds were safe and that it had located about $3 billion of the affected assets while working with partners to freeze them.

    Binance, Yahoo Finance. Original Statement 208 Captured .

  31. Reported recovery

    Hacken said that the Arbitrum Security Council moved 8,426 ETH and 74.6M ARB out of the attacker's reach at 00:08 UTC on October 30.

    Arbitrum Security Council, Hacken. Original Statement 22 Captured .

  32. Reported freeze

    TRM said the Arbitrum Security Council used its emergency powers at 00:08 UTC to force two transfers out of the attacker's wallet on Arbitrum, moving 8,426 ETH and 74.6 million ARB, about USD 30 million, out of the attacker's reach.

    Timeline row: TRM said the Arbitrum Security Council moved 8,426 ETH and 74.6M ARB out of the attacker's reach

    TRM Labs, TRM Labs. Original Statement 148 Captured .

  33. Reported freeze

    Cointelegraph reported that Binance said the current verified amount of assets frozen from the hack was $3 billion.

    Binance, Cointelegraph. Original Statement 124 Captured .

  34. Reported freeze

    Cointelegraph reported that the Arbitrum Security Council said it executed a transaction to freeze $30.5 million, involving 74.6 million ARB and 8,425 ETH, and that the funds were transferred to an intermediary frozen wallet.

    Timeline row: Cointelegraph reported the Arbitrum Security Council said it froze $30.5M; TRM and Hacken give 00:08 for the transfer (live-blog entry time)

    Arbitrum Security Council, Cointelegraph. Original Statement 125 Captured .

  35. Reported freeze

    LlamaRisk reported that the attacker’s position on Aave held around $59.9 million in USDT collateral against $43.8 million in debt, and Aave stated the position remained overcollateralized.

    LlamaRisk, Cointelegraph. Original Statement 393 Captured .

  36. Reported freeze

    Elliptic estimated that $2.84 billion had been frozen by 7:00 am UTC on Friday, while the attackers still controlled around $3.33 billion in assets that issuers could not immobilize.

    Timeline row: Cointelegraph reported Elliptic estimated $2.84B frozen by 07:00 UTC on Friday (Hacken gives the same figure at 08:00 UTC)

    Elliptic, Cointelegraph. Original Statement 395 Captured .

  37. Reported freeze

    Hacken said that the verified frozen total reached $2.84B, which is 44% of the theft, at 08:00 UTC.

    Timeline row: Hacken said the verified frozen total reached $2.84B, 44% of the theft

    Hacken. Original Statement 23 Captured .

  38. Reported freeze

    LlamaRisk stated that the second Risk Steward batch reduced borrow caps and draw caps on the largest borrow paths to about 2% above the amount borrowed just before the exploit, removing about $3.7B of unused borrow capacity on Aave V3 and $130M on Aave V4.

    LlamaRisk, Aave governance forum. Original Statement 1012 Captured .

  39. Official freeze

    Binance said in its Security Incident Update #2 that it had worked with law enforcement, blockchain intelligence firms, asset issuers and industry partners to trace and freeze affected assets, and that approximately $3 billion had been frozen on-chain to date.

    Binance, Binance. Original Statement 170 Captured .

No time stated

  1. No time stated
    Reported freeze

    Binance stated that it had frozen around $3bn of stolen assets after working with law enforcement, intelligence firms, and partners.

    Binance, BBC News. Original Statement 10 Captured .

  2. No time stated
    Reported freeze

    Hacken said Ripple and World Liberty Financial froze their tokens inside the compromised wallet, which stopped new deposits of those tokens from being taken.

    Hacken. Original Statement 26 Captured .

  3. No time stated
    Reported freeze

    Binance stated that it worked with blockchain partners to freeze roughly $3 billion in affected assets.

    Binance, npr.org. Original Statement 40 Captured .

  4. No time stated
    Reported freeze

    Elliptic has verified $2.85 billion of frozen or seized funds, which is 44% of the theft, mostly USDT and USDC.

    Elliptic, Elliptic. Original Statement 57 Captured .

  5. No time stated
    Reported freeze

    Elliptic said the Arbitrum Security Council took emergency action to move assets out of the attacker's reach, and that Optimism's governance appears to have done the same on October 31, moving 44 million OP (around $5 million).

    Elliptic, Elliptic. Original Statement 93 Captured .

  6. No time stated
    Reported freeze

    Elliptic said stablecoins make up 94% of the frozen funds, almost entirely on Ethereum and Tron, and that nothing stolen on Bitcoin, the XRP Ledger, Solana or NEAR has been frozen.

    Elliptic, Elliptic. Original Statement 94 Captured .

  7. No time stated
    Reported other

    Elliptic said the attacker converted around $786 million of stablecoins into ETH and TRX before the freezes landed.

    Elliptic, Elliptic. Original Statement 95 Captured .

  8. No time stated
    Reported other

    Elliptic said a second attacker wallet deposited 59.9 million USDT into Aave as collateral and borrowed 19,762 ETH before Aave froze the affected markets.

    Elliptic, Elliptic. Original Statement 97 Captured .

  9. No time stated
    Reported other

    Elliptic said 234 million USDT was swapped for 638 million TRX on SunSwap on Tron, and 48 million RLUSD was sold on Ethereum before Ripple froze the remainder.

    Elliptic, Elliptic. Original Statement 98 Captured .

  10. No time stated
    Reported freeze

    Blockaid said Tether and Circle froze about $1.8B in the main collection address within 40 minutes, and that with later freezes by other issuers and the Arbitrum Security Council, Binance puts the verified total frozen at about $3B.

    blockaid.io. Original Statement 103 Captured .

  11. No time stated
    Reported freeze

    Cointelegraph reported that Circle CEO Jeremy Allaire said Circle had frozen more than $800 million in USDC in coordination with law enforcement.

    Jeremy Allaire, Cointelegraph. Original Statement 115 Captured .

  12. No time stated
    Reported freeze

    TRM said Tether, Circle, Ripple and World Liberty Financial froze about USD 2.67 billion in stablecoins and Arbitrum's Security Council froze 8,426 ETH and 74.6 million ARB, a total of roughly USD 2.7 billion.

    TRM Labs, TRM Labs. Original Statement 138 Captured .

  13. No time stated
    Reported freeze

    Hacken said stablecoin issuers began freezing 56 minutes after the first transfer, that Tether acted first at 21:01 and Circle three minutes later, and that Binance suspended deposits and withdrawals that night and published a written update at 02:23 UTC.

    Hacken. Original Statement 158 Captured .

  14. No time stated
    Reported freeze

    Yahoo Finance reported that Tether said it froze nearly $1.57 billion in assets linked to the incident, while Circle froze more than $800 million.

    Yahoo Finance. Original Statement 159 Captured .

  15. No time stated
    Reported freeze

    WIRED quoted Elliptic's Tom Robinson as saying that around $2.8 billion, or around 44 percent of the total stolen, had been frozen so far, almost all of it stablecoins.

    Tom Robinson, WIRED. Original Statement 160 Captured .

  16. No time stated
    Official freeze

    Binance said in its Security Incident Update dated 2026-10-30 that it had worked with blockchain partners to freeze affected assets, with about $3 billion frozen on-chain so far.

    Binance, Binance. Original Statement 163 Captured .

  17. No time stated
    Reported freeze

    Chainalysis said approximately $2.8 billion had been frozen so far.

    Chainalysis, Chainalysis. Original Statement 192 Captured .

  18. No time stated
    Reported other

    Chainalysis said the attacker swapped $325 million in stablecoins into $285 million in ETH over nearly 20 minutes to try to stay ahead of the freezes.

    Chainalysis, Chainalysis. Original Statement 194 Captured .

  19. No time stated
    Reported freeze

    The Block reported that co-CEO Yi He said Ripple "promptly" froze roughly $200 million in associated funds.

    Yi He, The Block. Original Statement 204 Captured .

  20. No time stated
    Reported freeze

    The Guardian reported that Binance has said the attack began with a compromised employee laptop and involved multiple breach points, that it found no evidence of private-key leakage, and that it said roughly $3bn of affected assets had been frozen.

    Binance, The Guardian. Original Statement 223 Captured .

  21. No time stated
    Reported freeze

    Binance co-CEO Yi He said Ripple helped stop about USD 200 million from moving; TRM reports a 40.5M RLUSD freeze; the sources do not say whether the figures measure the same thing.

    Yi He, TRM Labs. Original Statement 243 Captured .

  22. No time stated
    Reported freeze

    Tom Robinson of Elliptic stated that the remaining $3.3 billion is mostly Bitcoin, Ether, and XRP, which cannot be frozen.

    Tom Robinson, WIRED. Original Statement 383 Captured .

  23. No time stated
    Reported freeze

    Decrypt reported that Tether and Circle had locked up about $2.39 billion between them, which it put at 43% of the haul, leaving somewhere between $2.6 and $3.2 billion still out there.

    Decrypt. Original Statement 663 Captured .

  24. No time stated
    Reported freeze

    Arkham stated that issuers had frozen $2.80 billion of the stolen funds, but $2.9 billion in various tokens could still be moved.

    Arkham Intelligence, Decrypt. Original Statement 680 Captured .

  25. No time stated
    Reported freeze

    Halborn said issuers froze about 2.8 billion dollars, most of it within 47 minutes of the main sweep, but that the attacker had moved 700 million USDT out of the hub before the first freeze and converted close to 800 million dollars of stablecoins into assets nobody can freeze.

    Halborn. Original Statement 764 Captured .

  26. No time stated
    Reported other

    Halborn said that by Elliptic's count about 3.33 billion dollars sat in roughly 43 addresses that nobody can freeze, including 511,861 ETH, 18,270 BTC, 233 million XRP and 670 million TRX.

    Halborn. Original Statement 767 Captured .

Blacklist events for addresses on our list only; other blacklist events in the same period are not shown, and an event does not by itself show involvement.

Blacklist events for addresses on our list, read from chain data (see the freeze scoreboard)
TimeChainTokenTargetTransaction
ethereumUSDT0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c
View on explorer
0x7baba482077843514d9c72bac0110ba0916b0814288a72917e2c3bb27a9d8659
View on explorer
ethereumUSDC0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c
View on explorer
0xc954c86f118e8e410e6a3eb9e3b38ff4a95fbdae9d2d58e13166afb7a1f4fc5f
View on explorer
ethereumUSDT0x28c6c06298d514db089934071355e5743bf21d60
View on explorer
0x312e166cb9e602582f426288f755a4b08e1eddb456b7e4bd614adae11080d305
View on explorer
ethereumUSDC0x28c6c06298d514db089934071355e5743bf21d60
View on explorer
0xb57c2143508019ac592a9dadb988b39003589f6f54c1924d4163f60520a784f5
View on explorer
ethereumUSDC0xee7ae85f2fe2239e27d9c1e23fffe168d63b4055
View on explorer
0xf2faba0e8ab74e84dde0c7ded90effe20a4cedbde1653f0c98220d2f774eeebb
View on explorer
ethereumUSDC0x294828705974ad04d86a24a2ff6efe762505a0ed
View on explorer
0x884b83c4ed4ddb0a33cb4977df7d9aa1b94ac14f8b7218680824955337fadb1c
View on explorer