Stablecoin issuers Tether, Circle and Ripple have moved to freeze more than $2.5 billion in assets linked to the suspected Binance hack, as the cryptocurrency exchange acknowledged reports of
Stablecoin issuers Tether, Circle and Ripple have moved to freeze more than $2.5 billion in assets linked to the suspected Binance hack, as the cryptocurrency exchange acknowledged reports of a potential security incident and said its teams were investigating. The latest interventions substantially expand the amount of assets targeted for freezing since the first suspicious transfers emerged on October 29. Meanwhile, blockchain intelligence platform Arkham shows approximately $5.84 billion in cryptocurrency holdings across 55 addresses grouped under the label "binance-hacker-1029", although that portfolio value should not be treated as a confirmed measure of stolen funds. Binance co-CEO Yi He publicly acknowledged the actions taken by all three stablecoin issuers and reiterated that user funds remain safe. Binance has not yet published a detailed incident report establishing the cause of the suspicious transfers or the exchange's financial exposure.
Tether Raises Binance-Linked Freeze to $1.57 Billion
Tether CEO Paolo Ardoino said the company had frozen more than 1.567 billion USDT associated with the potential Binance hack, a significant increase from the approximately $971 million initially reported by Binance founder Changpeng Zhao. Ardoino described protecting the cryptocurrency industry and Tether's partners as the company's priority. Yi He subsequently acknowledged the intervention on X, thanking Tether for the rapid action. Circle CEO Jeremy Allaire separately confirmed that his company had frozen more than $800 million in USDC associated with the incident. Allaire said Circle was coordinating with law enforcement and would continue supporting the investigation. In another development, Yi He thanked Ripple for promptly freezing approximately $200 million. Her statement did not identify the specific addresses involved or provide a breakdown of the affected assets. Based on the figures announced by the three companies and Binance's co-CEO, the interventions total more than $2.56 billion. However, the announcements do not establish how much represents distinct, currently immobilized balances, or whether subsequent freezing actions overlap with earlier reported figures.
The response highlights the unusual ability of centralized stablecoin issuers to intervene in a cryptocurrency security incident. Unlike Bitcoin or Ether, tokens such as USDT and USDC can be subject to issuer-level restrictions that prevent transfers from designated addresses. Freezing assets, however, does not automatically return them to Binance. Recovery may require further coordination with investigators, issuers and relevant authorities.
Arkham Tracks $5.84 Billion Across 55 Addresses
Blockchain analytics platform Arkham displays approximately $5.84 billion in cryptocurrency holdings across 55 addresses under the label "binance-hacker-1029", illustrating the scale of the wallet cluster being monitored following the incident. The portfolio snapshot shows approximately $1.77 billion in USDT, $1.44 billion in Bitcoin, $922 million in Ether and $823 million in USDC. Other significant holdings include approximately $247 million in TRX, $94.6 million in SOL and $75.4 million in wrapped Beacon ETH.
The Bitcoin balance alone represents approximately 18,270 BTC, while the Ether holdings total roughly 405,801 ETH across the monitored addresses. These figures are particularly significant because the apparent portfolio value exceeds earlier estimates of approximately $3.3 billion transferred from Binance hot wallets on Ethereum. That difference does not necessarily indicate additional losses. Arkham's figures represent a portfolio snapshot across multiple addresses and networks rather than a verified calculation of unauthorized withdrawals. The grouping may include assets acquired through swaps, funds already present in related wallets, or balances whose relationship to the suspected exploit has not yet been independently established. The holdings also include stablecoins that may be frozen. Consequently, the portfolio's displayed market value should not be interpreted as the amount available for immediate withdrawal or liquidation by whoever controls the wallets. Establishing the actual financial impact requires tracing the original outflows, subsequent transfers, asset conversions and any overlapping wallet balances without counting the same assets multiple times.
Aave Lending Activity Raises Questions About Further Exposure
The investigation may also extend into decentralized lending markets. A report circulating in the aftermath of the suspected exploit claims that an address associated with the attacker used USDT collateral to borrow approximately 20,000 wrapped Ether through Aave, worth about $44 million at prevailing prices. The reported transaction has not been independently verified, and it remains unclear whether the collateral was subsequently frozen or whether the borrowing position remains open. If confirmed, the transaction would introduce another dimension to the incident. An attacker could potentially use stolen stablecoins as collateral to obtain cryptocurrency that cannot be frozen directly by the original stablecoin issuer. However, borrowing against compromised assets does not automatically produce a loss for the lending protocol. The outcome would depend on the status of the collateral, the outstanding debt, the position's health factor and whether liquidations or repayments remain possible. There is currently insufficient evidence to conclude that Aave itself has suffered a loss or that its smart contracts were compromised.
Binance Confirms Investigation but Has Not Detailed Losses
Binance has now acknowledged reports of a potential security issue, saying its teams are aware of the situation and are actively investigating. The exchange's statement represents an important development from the period immediately following the suspicious transfers, when blockchain investigators were primarily relying on transaction records and wallet labels to assess whether the activity involved an exploit. Binance founder Changpeng Zhao previously said the activity appeared consistent with a hack and expressed confidence that users would be fully covered. Zhao stepped down as CEO in 2023 and does not manage the exchange's day-to-day operations. Yi He has also reiterated that user funds are safe, although the company has yet to disclose a definitive loss figure, a recovery timetable or the specific circumstances that enabled the transfers. The central questions are now how much of the transferred cryptocurrency remains accessible to the suspected attacker, whether the issuers can facilitate recovery of frozen assets, and whether Binance will disclose any operational restrictions or compensation arrangements. The distinction between frozen funds, recoverable assets and irreversible losses will be critical in determining the incident's ultimate financial cost. The size of a monitored wallet cluster alone cannot answer that question. FinanceFeeds will continue following Binance's investigation, issuer interventions and changes in the identified wallet balances as further evidence becomes available.
