Statements

The issuers froze about 2.8 billion dollars, and most of it within 47 minutes of the main sweep, but the attacker had moved 700 million USDT out of the hub before the first freeze landed and converted close to 800 million dollars of stablecoins into assets nobody can freeze.

On Friday, the company said it had frozen around $3bn of stolen assets after working with law enforcement, intelligence firms and partners.

Worked with law enforcement, blockchain intelligence firms, asset issuers and industry partners to trace and freeze affected assets. Approximately $3 billion has been frozen on-chain to date.

Circle CEO Jeremy Allaire said the company had frozen more than $800 million in USDC in coordination with law enforcement and would continue supporting the investigation.

Stablecoin issuers began freezing funds 56 minutes after the first transfer. Tether acted first, at 21:01, about 37 minutes after the big Ethereum transaction, and Circle followed three minutes later. Binance suspended deposits and withdrawals that night and published a written update at 02:23 UTC, a little over six hours after the first transfer.

Ripple and World Liberty Financial froze their tokens inside the compromised wallet, which stopped new deposits of those tokens from being taken.

Binance said it worked with blockchain partners to freeze roughly $3 billion in affected assets.

Stablecoins make up 94% of the frozen funds, almost entirely on Ethereum and Tron. Arbitrum and Optimism are the only blockchains where everything stolen has been secured, in both cases by the network's own governance. Nothing stolen on Bitcoin, the XRP Ledger, Solana or NEAR has been frozen, because native assets have no issuer that can freeze them.

The Arbitrum Security Council took emergency action to move assets out of the attacker's reach, and on October 31 Optimism's governance appears to have done the same, moving 44 million OP (around $5 million) out of the attacker's address.

Elliptic has verified $2.85 billion of frozen or seized funds, 44% of the theft, almost all of it USDT and USDC. The attacker is swapping the rest into ETH and other assets that cannot be frozen, and moving funds between blockchains, using automated scripts that run around the clock.

Ripple "promptly" froze roughly $200 million in associated funds, co-CEO Yi He [said]

Tether and Circle froze about $1.8B in the main collection address within 40 minutes, and with later freezes by other issuers and the Arbitrum Security Council, Binance puts the verified total frozen at about $3B.

“The remaining $3.3 billion is mostly Bitcoin, Ether, and XRP, which no one can freeze,” Robinson says.

Elliptic’s Robinson says that around $2.8 billion, or around 44 percent of the total amount stolen, has been frozen by crypto companies and exchanges so far, with almost all of this being stablecoins.

Tether and Circle used it, locking up about $2.39 billion between them. That’s 43% of the haul. That leaves somewhere between $2.6 and $3.2 billion still out there.

Stablecoin issuer Tether said it froze nearly $1.57 billion in assets linked to the incident, while Circle froze more than $800 million.

Approximately $2.8 billion has been frozen so far.

08:00 | Verified frozen total reaches $2.84B, 44% of the theft.

Binance has said the attack began with a compromised employee laptop and involved multiple breach points. It found no evidence of private-key leakage and said roughly $3bn of affected assets had been frozen.

Binance co-CEO Yi He said Ripple helped stop about USD 200 million from moving; TRM has confirmed the 40.5 million RLUSD freeze onchain.

Tether, Circle, Ripple and World Liberty Financial froze about USD 2.67 billion in stablecoins, and Arbitrum's Security Council froze 8,426 ETH and 74.6 million ARB on its network, for a total of roughly USD 2.7 billion.

Elliptic estimated that $2.84 billion had been frozen by 7:00 am UTC on Friday, while the attackers still controlled around $3.33 billion in assets that issuers could not immobilize.

We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.

LlamaRisk, an Aave risk service provider, said in its 1:00 am update that the attacker’s position subsequently held around $59.9 million in USDT collateral against $43.8 million in debt. Aave said the position remained overcollateralized and did not put protocol suppliers at risk.

The update came after the Arbitrum Security Council said it executed a transaction to freeze $30.5 million from the Binance exploit, involving 74.6 million Arbitrum (ARB) and 8,425 Ether (ETH). “The Security Council acted by weighing its commitment to the security and integrity of the Arbitrum community and Arbitrum governance without impacting any Arbitrum users or applications,” it said. “As of October 30, 2026 time, the funds have been successfully transferred to an intermediary frozen wallet,” it said.