The freeze button decided who lost

At 07:37 UTC on October 30, Richard Teng, Binance’s co-CEO, wrote to the exchange’s users on X.

“I want to speak to you directly about what happened. Bottom line - your money is safe, and we're covering every loss.”

Eleven hours earlier, at 20:24 UTC on October 29, attackers had started pulling money out of Binance hot wallets. By ZachXBT’s count it came to about $6.3 billion. Binance later said it had reserved $6.34 billion to cover the loss.

A lot had happened in those eleven hours. By 00:52 UTC, a few hours after the first reports, Binance said around $3 billion had already been frozen.

Nearly half of the money was stopped before the attacker could use it. Most of the part with a name on it was stopped by the companies that issue the tokens: Tether and Circle together account for about $2.4 billion of it.

FIG. 01 · CAPITAL SPLIT

About $3.0B of the $6.3B taken from Binance was reported frozen within hours. Tether and Circle account for most of it.

US dollars, as reported Oct 29 to Nov 1, 2026 · Total ~$6.3B

Reported frozen within hours~$3.0B

• Tether froze USDT1.567B USDTPaolo Ardoino (Tether)
• Circle froze USDC~$823MCZ
• Arbitrum Security Council~$30.5MZachXBT (Arbitrum)
• Not attributed to a party in reports~$580Mderived

Not reported frozen~$3.3B

• 130+ altcoins sold for ETH and USDC~$279MLookonchain (altcoins)
• 970,522 SOL being swapped to BTC via Relay~$95.9MLookonchain (SOL)
• Not traced in public reports~$2.93Bderived

• One rushed sale: 908,793 PROM (~$5M) returned 0.0316 ETH, about $71. Lookonchain (PROM)

Sources: ZachXBT, Binance, Paolo Ardoino (Tether), CZ, ZachXBT (Arbitrum), Lookonchain (altcoins), Lookonchain (SOL), Lookonchain (PROM). Figures were reported at different times between Oct 29 and Nov 1 and are not independently verified onchain. The frozen total is Binance's; each named part is what that party reported. Remainders are totals minus named parts.

Stablecoins have an off switch

The first public thanks came from Binance’s founder, less than an hour into the drain.

“User funds are safe! It does look like a hack on Binance. Appreciate the quick freeze from Tether (~$971m) and Circle (~$823m).”

Ten minutes later, Tether’s CEO put a number on his side of it.

“Tether froze more than 1.567B USDT related to a potential Binance exchange hack. Protecting the industry and our partners is our main priority.”

CZ’s early figure for Tether, about $971 million, grew to more than 1.567 billion USDT by Ardoino’s count. Circle’s freeze, about $823 million, matches what still sits blacklisted in the main receiving wallet today. Arbitrum’s Security Council executed a transaction to freeze roughly $30.5 million on its own chain, according to ZachXBT, who is one of the signers.

A stablecoin is a balance in a company’s ledger, written onchain. When the company says no, the money stops moving. In a normal week that is the part of crypto people complain about. This week it was the part that worked.

Everything else ran

ETH, SOL and BTC have no issuer to call. So the attacker did the obvious thing with what was hard to hold: sold it, mostly for ETH, which nobody can freeze.

On EVM chains alone, Lookonchain counted more than 130 altcoins dumped for 123,400 ETH and 1.69 million USDC, about $279 million. On Solana it tracked 970,522 SOL, about $95.9 million, being swapped to BTC through Relay.

I read the main Ethereum wallets myself. One call to Binance 14 at 20:24 UTC moved 63 tokens in a single transaction, all to one wallet. On November 3 that wallet still holds 1.175 billion USDT and 823 million USDC, and both tokens report it as blacklisted. The ETH went elsewhere: one wallet holds 197,460 ETH and has never sent a transaction, another holds 137,602 ETH. Nobody can blacklist those.

FIG. 02 · WHERE THE MONEY WENT

The stablecoins were frozen where they landed. The ETH sits in wallets no one can freeze, and the altcoins were sold off.

Ethereum wallets read onchain by Tat Thang, Oct 29 and Nov 3, 2026

Stablecoins

1. One call to Binance 14 moves 63 tokens in a single transaction0x28C6…1d60Etherscan: sweep transaction · read onchain block 26,300,770, 20:24 UTC Oct 29
2. All 63 transfers land in one wallet0x5227…2f8cEtherscan: sweep transaction · read onchain same transaction
3. It still holds 1.175B USDT and 823M USDC, both blacklisted0x5227…2f8cEtherscan: Exploiter 2 · read onchain block 26,335,147, Nov 3

Frozen, still blacklisted

ETH

1. 195,460 ETH forwarded to a fresh wallet0x8532…43D4Block6iQ
2. It holds 197,460 ETH and has never sent a transaction0x8532…43D4Etherscan: Exploiter 8 · read onchain block 26,335,151, Nov 3
3. A second wallet holds 137,602 ETH0xc887…286AEtherscan: Exploiter 19 · read onchain block 26,335,151, Nov 3

No off switch

Altcoins and SOL

1. 130+ altcoins sold on DEXs for ETH and USDC (~$279M)Lookonchain (altcoins)
2. 970,522 SOL being swapped to BTC through RelayLookonchain (SOL)
3. Funds pass THORChain and mix with money from the Bitget exploit0x1510…feb7ZachXBT

Sold and kept moving

Sources: Etherscan: sweep transaction, Etherscan: Exploiter 2, Block6iQ, Etherscan: Exploiter 8, Etherscan: Exploiter 19, Lookonchain (altcoins), Lookonchain (SOL), ZachXBT. Wallet labels are Etherscan's (Binance Hot Wallet Exploiter 2, 8, 19). Labels describe fund flows; a wallet does not prove who holds it.

Speed cost money. The attacker sold 908,793 PROM, worth roughly $5 million, into a nearly empty Uniswap V2 pool and got back 0.0316 ETH. About $71. Earlier, around $3.32 million of tokens went to the NEWT token contract by mistake, where Lookonchain says they cannot be recovered.

A thief in a hurry is a bad trader. Thin liquidity punishes bad traders without asking who they are.

Someone earns on the way out

Laundering is not free, and the fees land somewhere. On November 1 the analyst Dethective published a table of the protocols that earned the most revenue from DPRK-linked laundering, with the method attached: wallets from Elliptic and FBI hack lists plus wallets traced from them, every Tron transfer from October 29 to November 1, and revenue counted the way DefiLlama defines it.

He also flagged a swap router named BWSwapRouterV1 that took exactly 0.3% of every swap the hack wallets made, and left it out of the table because he could not confirm who runs it.

That is the uncomfortable part. A permissionless router does not ask where the money came from. Every swap a thief makes pays somebody.

ZachXBT says the Binance funds were mixed at one address with funds from the $388 million Bitget exploit, after the money arrived via THORChain, and that the same actor is likely behind both. He attributes Bitget to TraderTraitor, a group linked to North Korea. That attribution is his, read from fund flows. A wallet does not prove who holds it.

It was not one hack

The same week, BTCPay Server said attackers were going after instances running version 2.4.1 or older, with no credible reports of drains on the current 2.4.7. Mercado Bitcoin, the Brazilian exchange, lost more than $46 million according to Lookonchain, with over $9 million already frozen. Lookonchain, citing ZachXBT, also reported an EU entity suspected of losing more than $106 million from accounts on centralized exchanges. ZachXBT says that actor is not Lazarus but French-speaking.

FIG. 03 · SAME WEEK

Four incidents in one week, from a $6.3B exchange drain to a flaw in payment servers.

As reported, Oct 29 to Nov 3, 2026

Victim	Lost	Frozen
Binance	~$6.3BZachXBT	~$3BBinance
Mercado Bitcoin	> $46MLookonchain	> $9MLookonchain
An EU entity (CEX accounts)	> $106MLookonchain citing ZachXBT	Not disclosed
BTCPay Server (2.4.1 and older)	Not disclosed	Not disclosed

Sources: ZachXBT, Binance, Lookonchain, Lookonchain citing ZachXBT, BTCPay Server. Amounts are the first public figures and may be revised.

And the Binance breach itself, by Binance’s own early account, may have started with a compromised laptop belonging to a DevOps engineer, which gave the attacker access to a service container. Not a smart contract bug. A laptop.

What I take from it

Binance says users will not pay for this. By October 31 it said 90% of the stolen assets had been replenished. Withdrawals have been reopening in phases, and by 03:00 UTC on November 3 it reported hourly deposits running ahead of withdrawals.

The lesson I take is narrower than “exchanges are unsafe”. In this hack, what the money was held in decided much of what could be stopped. Most of the frozen money that has a name on it was stablecoins. The ETH in the attacker’s wallets could not be frozen at all.

If you hold size anywhere, it is worth knowing which of your assets have an off switch, who holds it, and whether you would want them to press it.

Not financial advice.