Metric | Value |
|---|---|
Total stolen | $6.43B |
Verified frozen funds | $2.84B |
Share frozen | 44% |
Assets that cannot be frozen | $3.23B |
Stablecoins swapped before freezes | $786M |
Time to first freeze | 37 min |
Stablecoin issuers froze $2.84B of the $6.43B stolen from Binance on October 29, according to Elliptic's analysis, but the rest now sits in ETH, BTC, XRP and TRX, assets no issuer can block.
Who froze what, and how fast
The stolen USDT reached the attacker's main Ethereum wallet at 20:24 UTC. Tether froze that wallet 37 minutes later, locking 1.18B USDT in place, then followed the funds and blacklisted four more addresses within 17 minutes.
Circle froze 823M USDC in the same wallet three minutes after that.
- Ripple, World Liberty Financial, Paxos and First Digital froze further stablecoins
- Tether froze tokenised gold and Binance froze the WBETH it issues
- The Arbitrum Security Council took emergency action to move assets out of the attacker's reach
- Stablecoins make up 94% of the frozen funds, almost entirely on Ethereum and Tron
Binance estimates around $3B frozen. Elliptic has verified $2.84B on-chain, 44% of the theft.
What the hackers swapped in time
Before the freezes landed, the attacker converted around $786M of stablecoins into ETH and TRX. The swaps implied a loss of 12% to 26% against market price, a sign that speed mattered more than value.
Operation | Amount sold | Result |
|---|---|---|
USDT to ETH via Uniswap, 1inch and RFQ | 434M USDT | 160,451 ETH |
USDT to TRX via SunSwap (Tron) | 234M USDT | 638M TRX |
RLUSD sold before Ripple froze the remainder | 48M RLUSD | - |
AVAX to USDC to CCTP to ETH | all stolen AVAX | 7,242.8 ETH |
A second attacker wallet deposited 59.9M USDT as collateral on Aave and borrowed 19,762 ETH before Aave froze the affected markets. The loan is still open and close to liquidation, and Elliptic's frozen total excludes this position.
What cannot be frozen
At current prices, the attacker controls around $3.23B in assets with no issuer, spread across dozens of addresses.
- 519,104 ETH, worth $1.15B
- 18,270 BTC ($1.39B), split across 19 addresses, most holding 1,000 BTC each
- 233M XRP, sitting in a single address
- Around 575M TRX, of which $20M to $36M has already left via swap services and cross-chain bridges, mostly into ETH
Elliptic says these funds can only be stopped when they reach an exchange or other service. The firm has published a free blocklist of more than 1,000 addresses linked to the theft and confirmed that some of the Tron funds have been laundered alongside proceeds of the September 2026 Bitget exploit.
Frozen is not recovered
Elliptic's figures count on-chain freeze and blacklist events at current prices, not funds returned to Binance or its users.
Binance has said it will cover all losses from its SAFU fund and company funds, and has reserved more than $6.34B to do so. Co-CEO Richard Teng said in a video update on October 30 that he hoped withdrawals would resume before Sunday.