--- title: Tether and Circle Froze About $2.6 Billion of the Record $6.3 Billion Taken From Binance description: Tether and Circle froze about $2.6 billion after the record Binance theft. What was stopped, what is out of reach, and whether Binance funds are safe. author: Darie Nani (Editor-in-Chief) date: 2026-11-01T15:43:51.315Z updated: 2026-11-01T15:43:51.333Z canonical: https://www.sovereignmagazine.com/article/binance-hack-tether-circle-freeze-safu image: https://cdn.nanimediahouse.com/richard-teng-binance-stage-514056.webp categories: Blockchain content_type: News region: Global publication: Sovereign Magazine schema_type: Article --- An attacker moved about $6.3 billion out of Binance on Thursday, October 29, by Binance's own estimate. TRM Labs, Chainalysis and Elliptic, which put the loss at $6.36 billion to $6.43 billion and say most of it left in about 20 minutes, each call it the [largest crypto theft on record](https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history), about four times the [$1.5 billion taken from Bybit](https://www.sovereignmagazine.com/article/bybit-north-korea-court-injunction-nft-notice) in February 2025. Tether began freezing stablecoins tied to the theft at 21:01 UTC, 37 minutes after the main sweep, and Circle followed three minutes later, according to TRM's timeline. Paolo Ardoino, Tether's chief executive, said on X that Tether "froze more than 1.567B USDT related to a potential Binance exchange hack." Jeremy Allaire, Circle's co-founder and chief executive, said that "in coordination with law enforcement," Circle had frozen "more than 800M USDC associated with the incident." TRM's later count, across several blockchains, is about 1.77 billion USDT and about 825 million USDC, or roughly $2.6 billion between the two companies. A stablecoin issuer can freeze its tokens at a given address, so the USDT and USDC frozen in the attacker's wallets cannot be moved. "No company issues bitcoin or ether and no company can freeze either one," Patrick Tan of ChainArgos told Reuters. A frozen token does not go back to Binance, but Reuters reported that a freeze "significantly limits the attackers' ability to convert them into cash." Binance's verified frozen total rose from $2.54 billion late on Thursday to "around $3 billion" early on Friday. Ripple and World Liberty Financial also froze tokens they issue, according to Binance co-CEO Yi He. ## The Attacker Still Controls About $3.3 Billion That No Issuer Can Freeze Elliptic says the attacker controls about $3.33 billion in assets that no issuer can freeze, mostly ether and bitcoin, plus XRP and Tron's TRX token. TRM puts the ether and bitcoin alone at about $2.4 billion. TRM also says the attacker sold about 325 million USDT to market makers for ether at a discount of more than 10%, and borrowed more ether on the lending platform Aave against 60 million USDT. ## Binance Says It Will Cover Every Loss From the SAFU Fund and Company Money Binance says it "will cover all losses from the SAFU fund and the company's funds" and that user funds are safe. On Friday it said it had "already reserved over $6.34B of company funds to cover this incident," with [$5 billion of that already held in the exact tokens that were taken](https://x.com/binance/status/2116121748555153621), and that it is buying the rest through market and over-the-counter channels. Those figures leave out the frozen assets, which are still going through recovery and verification, and Binance says it "has begun recovering affected assets for users." Binance has 335 million registered users and held about $162.8 billion of assets in custody as of its 2025 annual report, according to Reuters, which describes SAFU, the Secure Asset Fund for Users, as a $1 billion bitcoin reserve meant to protect customer assets if the exchange is breached, citing Binance's website. Binance has not given the fund's current balance in its statements on the incident. NBC News noted that, unlike traditional bank deposits, funds kept with companies like Binance "are not automatically insured against losses." Binance says it will publish an updated Proof of Reserves once remediation is complete. Binance says deposits are unaffected. Withdrawals are paused, and Binance says the outflows stopped when it paused them. At 08:47 UTC on Friday, the company said it was "still on track towards the expected timeline to resume the withdrawal service in 45 hours." ## Binance Says the Attack Began With a DevOps Engineer's Laptop Binance says its initial investigation points to a compromised DevOps engineer's laptop, which gave an attacker access to a "service container" where the attacker submitted unauthorized withdrawal transactions. Binance says it has found "no evidence of any wallet private key leak," and on Friday it said it had since uncovered "additional points of breach." Teng said the attacker "did not simply use one engineer's permissions, and this was not a single 'one-click' action." Binance has not yet published a root cause and has promised a detailed technical post-mortem once the investigation is complete. ## Analytics Firms Blame North Korean Hackers, but No Government Has Confirmed the Link TRM, Chainalysis and Elliptic attribute the attack to TraderTraitor, a North Korean hacking unit, and TRM says it holds that view "with high confidence." No government or law enforcement agency has confirmed who did it, and Binance has not commented on who was responsible. Elliptic notes that the FBI named North Korea for the Bybit hack within five days and that no similar statement has been made this time. Abu Dhabi's Financial Services Regulatory Authority, which issued Binance's main operating license, says it is engaging closely with Binance and monitoring the incident. The UK's Financial Conduct Authority says it is engaging with the company to understand the impact. ## Bitcoin Fell to a Six-Week Low and Coinbase Shares Fell More Than 5% Before the Market Opened Bitcoin hit a six-week low of $76,368, and Binance's BNB token fell 5.3% over 24 hours to $699.54, Reuters reported, citing CoinGecko. Shares of Coinbase and Strategy fell more than 5% in premarket trading on Friday, according to Investing.com. ## FAQ **Q: Is Binance.US affected by the hack?** Binance.US said its platform is not affected, the BBC reported. **Q: What is TraderTraitor?** TRM Labs describes TraderTraitor as North Korea's elite hacking unit. The cybersecurity firm Check Point says it is also known in the industry as Lazarus Group. **Q: Can Ripple freeze XRP?** No. Elliptic says Ripple can freeze its RLUSD stablecoin but not XRP, which is why the attacker's XRP is among the assets no issuer can stop. **Q: How much do hackers steal from crypto platforms in a typical year?** Attackers stole $2.9 billion of cryptocurrency across nearly 150 incidents last year, according to TRM Labs, as reported by Reuters. The Binance theft alone is more than twice that.