Binance hack: who decides when stolen crypto is frozen?

Tether made its first major freeze of stolen Binance funds 37 minutes after they reached the attacker’s main Ethereum wallet, according to Cointelegraph’s account. Binance says about $3bn of the roughly $6.3bn taken on 29 October has been frozen, while no government has confirmed who was responsible.

The first emergency freezes and the first public attributions both came from private companies. That is a story about power, and it says more than the breach itself.

The breach was not a failure of cryptography. Binance said it began with a compromised laptop that let an attacker reach a service container and submit unauthorised withdrawals, then said it had uncovered additional points of breach. It has published no root cause. TRM Labs, in its own report, found that the attacker had obtained 50 authorisations signed in advance by a Binance wallet, so that one would remain valid as transactions continued. It assesses that the attackers probably compromised the infrastructure Binance uses to sign withdrawals. The blockchain did what it was told. The control layer around it failed.

The brake sits with two companies

Tether froze more than $1.567bn of USDT and Circle more than $800m of USDC, according to their chief executives as reported by CNBC. Ripple and World Liberty Financial froze assets too, and Arbitrum’s Security Council froze about $30m. In its 31 October update, Elliptic had verified $2.85bn frozen or seized, about 44% of the theft, almost all of it USDT and USDC.

The mechanism is mundane. Stablecoins carry functions that let the issuer block transfers, which bitcoin has no equivalent of. Elliptic puts what the attacker controls and no issuer can freeze at about $3.21bn at that snapshot’s prices, including roughly $1.4bn in bitcoin and $1.2bn in ether. Both figures can change quickly. It also notes that the attacker was slow to convert stablecoins, unlike the pace usually seen from North Korean groups, which gave issuers time to act. The brake caught what moved too slowly or sat in the wrong form.

A freeze is not a recovery. Lawyers told CoinDesk that issuers act under contractual powers, sanctions duties or requests from authorities, and that a freeze does not settle who owns the money. Tether can destroy frozen tokens and issue replacements, and Circle can arrange a return through an authorised process, but establishing entitlement still takes legal work. A company can immobilise an asset in minutes without being the body that decides where it should go.

For the claim that crypto offers neutral settlement, this matters. The ledger is decentralised. The emergency brake is not.

Why this freeze, and not the last one

On 1 April, attackers drained roughly $285m from Drift, a Solana trading platform. About $232m of USDC moved through Circle’s own transfer protocol while, the investigator ZachXBT said, Circle had hours to act. It did not freeze the funds. Its chief executive, Jeremy Allaire, said Circle freezes at the direction of law enforcement or the courts, and described deciding for itself as a moral quandary. He has backed a legal safe harbour for issuers in the Clarity Act. Drift investors have sued, and investigators have since attributed that theft to North Korea too.

In October Circle said it froze USDC in coordination with law enforcement. That may be consistent with Circle’s stated policy. But coordination with law enforcement does not establish whether Circle acted on an official request or exercised its own contractual discretion. Tether’s chief executive said protecting the industry and its partners was the priority, and his post did not say whether anyone had instructed the freeze. Tether took a similar position over Tornado Cash addresses in 2022. A former exchange executive, Anton Golub, told CoinDesk he supports freezing but sees a double standard. Another commentator, Frank Hepworth, called the decision a business one, given the size of the theft.

The powers themselves are not secret. Circle’s published USDC risk disclosures say it may block addresses it determines, in its sole discretion, are associated with illegal activity, as well as on a government directive or in extraordinary circumstances. What the public cannot see is which ground applied to Binance, which applied to Drift, and whether the two were treated consistently. Nothing in the record shows the Binance freezes were wrong, or that Binance was favoured. The question is whether a victim can understand how the rules were applied to them, and whether the decision can be independently reviewed.

Attribution runs the same way

Naming the culprit followed the same pattern. TRM attributes the theft with high confidence to TraderTraitor, North Korea’s cryptocurrency theft unit. Its indicators include small Tornado Cash withdrawals funding an operator wallet, preparation that began at least 36 hours earlier, and signatures prepared in advance and executed in one burst, all matching earlier thefts such as Bybit. Chainalysis says in its own post that its investigators assess the hack to be TraderTraitor’s work, without giving a confidence level, and calls its investigation ongoing. Its strongest evidence is stolen Binance funds mixing in real time with proceeds of the previous month’s Bitget theft, which was attributed to North Korean actors.

Elliptic is more cautious. It calls North Korean involvement likely and warns that laundering networks can serve several clients, so a shared link does not prove one hacker did both thefts. No agency has confirmed attribution. The FBI attributed Bybit to TraderTraitor within about five days, and has said only that it is aware of this incident. These are patterns of tradecraft. They support a judgment, not a verdict. If it holds, those responsible are beyond Western courts, and for now the label and the freeze are doing the enforcement.

The case for discretion, and what should come next

The strongest defence of fast freezing is simple. A state that funds weapons programmes through theft will not wait for a court order, and a freeze that arrives after the swap is worthless. The case for Circle’s caution is just as real: an issuer that can freeze whenever it sees fit can freeze for reasons unrelated to protecting victims, and wrongful freezes carry liability. Users who want neutrality can hold bitcoin, which is where the attacker put much of the money. Experts consulted by CoinDesk mostly backed the freezes. Stefan Muehlbauer of CertiK argued for clearer legal standards and protection for companies that freeze in good faith.

That is the practical way forward. The power to freeze stolen crypto already sits with a few private firms, and their documented powers are broad. The gap is in scrutiny: how those powers are applied, why similar victims may get different responses, and what remedy exists when a freeze is wrong or a freeze never comes. Legal cover for good faith action is worth having. It is worth more with a published standard and a route to challenge, so that every victim can know what protection they are entitled to, regardless of the size of their loss or who they are.

Sources: TRM Labs, Elliptic and Chainalysis original reports (read directly); Circle’s published USDC risk disclosures (read directly); statements by Tether and Circle executives as reported by CNBC, CoinDesk and The Block; also Cointelegraph, NBC News, France 24, The Hacker News, DL News, Security Affairs.