How much USDT is really frozen in the Binance hack? Counted directly in the Tether and Circle contracts: the attacker address "Binance Hot Wallet Exploiter 2" holds 1,175.5 million USDT and 8
How much USDT is really frozen in the Binance hack? Counted directly in the Tether and Circle contracts: the attacker address "Binance Hot Wallet Exploiter 2" holds 1,175.5 million USDT and 823.0 million USDC, and both balances are frozen. That is about $2.0 billion the attacker can no longer move. But about 700 million USDT had already been pushed to two new addresses, and those were empty when Tether blacklisted them. Measured on October 29 at about 22:50 UTC.
What happened tonight is in our Binance hack report and our crypto crash timeline.
Tether CEO Paolo Ardoino reports more than 1.567 billion USDT frozen, Circle CEO Jeremy Allaire more than 800 million USDC. We queried the contracts' blacklist for every known attacker address:
Address USDT USDC Status 0x5227…2f8c (Exploiter 2) 1,175.5M 823.0M both frozen 0x9749…C762 0 (500M received at 20:30 UTC) 0 blacklisted but empty 0x0Ddf…697e 0 (200M received at 20:33 UTC) 0 blacklisted but empty 0x8532…43D4 195,460 ETH cannot be frozenSource: blacklist and balance functions of the USDT and USDC contracts queried via a public Ethereum node, transactions via Blockscout. The difference to Ardoino's 1.567 billion therefore sits on other addresses that could not be conclusively identified by press time.
AI-generated illustration
The attacker moved fast. At 20:30 and 20:33 UTC he sent 500 and 200 million USDT to two fresh addresses, about ten minutes after draining the Binance wallet and long before Tether reacted. From there the funds moved on within 25 minutes:
When Tether blacklisted the first two addresses, they were empty. The same pattern showed in the Bitget hack in September, when stablecoins were swapped within minutes and only about $318,000 could be frozen, as Decrypt reported. This time Tether was faster on the bulk.
USDT and USDC are not coins like Bitcoin but tokens issued by a company. The contract has a blacklist: once Tether adds an address, it can no longer send USDT. Circle has the same power over USDC and says it works with law enforcement:
Circle is closely tracking reports of a potential exploit involving Binance. In coordination with law enforcement, we have frozen more than 800M USDC associated with the incident and will continue supporting the investigation.
Jeremy Allaire (@jerallaire) October 29, 2026
Tether froze more than 1.567B USDT related to a potential Binance exchange hack. Protecting the industry and our partners is our main priority. Stay safe everyone.
Paolo Ardoino (@paoloardoino) October 29, 2026
AI-generated illustration
More on the Binance hack
Technically yes, any address can be blacklisted. In practice it hits addresses linked to theft, fraud or sanctions, usually on a tip from investigators. Holders of USDT from clean sources who do not trade with hacked addresses are generally not affected. That risk is the price of stablecoins having an issuer that can step in, as it did tonight.
Frozen does not mean returned. The roughly $2 billion is blocked, and Tether and Circle could later reissue it to the victim. Still open are the 700 million USDT that moved on and the 195,460 ETH nobody can freeze. How Binance covers the rest is the key question of the night. The withdrawal status is in our article Binance withdrawals after the hack; devices for self-custody are in our hardware wallet comparison.
This article is not investment advice.
