The response to Binance’s October 29 security incident became a race between blockchains that move assets continuously and organizations that can stop particular tokens from moving. Binance e
The response to Binance’s October 29 security incident became a race between blockchains that move assets continuously and organizations that can stop particular tokens from moving.
Binance estimated that about $6.3 billion was affected and said roughly $3 billion had been frozen by its October 30 update. Blockchain forensics firm TRM Labs put the amount blocked in its earlier chain-level snapshot at approximately $2.7 billion, including stablecoins and assets intercepted through an emergency action on Arbitrum. The figures refer to different reporting times and methods, not two separate recoveries.
Issuers such as Tether and Circle can blacklist addresses associated with their tokens, preventing transfers from those addresses. This is a powerful containment tool, but it does not automatically restore money to the exchange. A token can be frozen in place while recovery, legal and accounting processes remain unresolved.
TRM said Tether froze roughly $1.77 billion of USDT, Circle roughly $825 million of USDC and other issuers also acted. Its October 30 00:30 UTC snapshot counted about $2.7 billion stopped across those interventions and Arbitrum’s network-level emergency action. Binance’s later, broader estimate was about $3 billion frozen.
The limitation is straightforward. A stablecoin issuer can block its own tokens, but it cannot freeze native ether in someone else’s wallet. TRM traced approximately $325 million of USDT sold through decentralized exchange execution systems in return for about 122,300 ETH. The transactions reportedly accepted unfavorable pricing to move quickly.
TRM also described an attacker-linked wallet supplying $60 million in USDT to Aave and borrowing approximately 19,760 ETH against the collateral. Aave subsequently froze affected Ethereum markets as a precaution. These were uses of lending and exchange protocols during the attempted movement of stolen funds, not evidence that Aave or Uniswap suffered a new smart-contract exploit.
A separate transaction path on Tron and several hops through other addresses illustrates the same objective: change the form of the assets before the next freeze arrives.
TRM reported that Arbitrum’s Security Council used emergency powers to move approximately 8,426 ETH and 74.6 million ARB, around $30 million combined, out of the attacker’s reach.
That is distinct from an issuer freezing its own stablecoin. It reflects extraordinary network governance powers that may preserve assets in a crisis but also prompt questions about who can intervene in transactions and under what conditions.
The incident demonstrates three competing properties of modern crypto finance: rapid settlement, issuer-controlled blocking and network-level emergency controls. None works consistently across every asset and chain.
TRM estimated that the attacker still controlled more than 420,000 ETH and 18,270 BTC in assets beyond issuer freeze powers in its early snapshot. Those figures will move as transactions, prices and tracing improve.
Whether and how frozen tokens will be returned, which market participants absorbed any trading losses, and when affected DeFi markets will fully normalize remain separate questions from Binance’s promise to compensate its own customers.
Sources
1. TRM Labs, on-chain tracing, freezes and DeFi swaps
