Binance said it had frozen about $30 billion in stolen assets after a breach of its hot wallets across several blockchain networks triggered nearly $63 billion in outflows in less than an hour. The incident, as described in public tracking dashboards attributed to blockchain investigator ZachXBT, involved Ethereum, Bitcoin, TRON and layer-2 networks including Arbitrum, Avalanche, Optimism and Base.
The recovery effort has centered on assets whose issuers or administrators can block transfers at the token-contract level. Tether, Circle, Paxos, World Liberty Financial, StraitsX and Binance's own wrapped ETH product all used blacklist or administrative controls to immobilize funds in wallets associated with the breach.
Stablecoins account for most of the assets reported frozen so far, placing the response in sharp contrast with the remaining Bitcoin and Ether holdings, which cannot be stopped through a central token blacklist once transferred on their native networks.
Tether and Circle froze billions in stablecoins
Tether froze 1,767,593,979.80 USDT after beginning blacklist actions at 5:05 Beijing time, according to the tracking data cited in the report. The first action locked 971 million USDT, followed minutes later by an expanded freeze that brought the total to 1.567 billion USDT before further actions increased the reported amount.
The issuer also blacklisted 12,574.05 XAUT, its gold-backed token, valued at roughly $35 million, along with 6,185,900.10 USDT0.
Circle froze all 823 million USDC linked to two movements involving an address identified as Binance 34. The outgoing transfers were recorded at 4:41 and 4:59 Beijing time, while the USDC blacklist action was completed at 5:13, rendering the tokens immobile in the associated addresses.
The timeline shows how stablecoin issuers can limit a hacker's ability to move or convert stolen funds, provided the assets remain in forms controlled by token contracts with freeze functionality. Such controls do not retrieve the tokens automatically, but they can prevent their transfer, redemption or use on compliant platforms.
Other token issuers joined the response
Other issuers froze smaller balances found in linked wallets. RLUSD froze 40,541,065 tokens, valued at approximately $40.54 million. World Liberty Financial froze 27,824,039.94 USD1, worth about $27.82 million, and 48 million WLFI, valued at roughly $2 million.
Paxos froze 215,657.65 USDP, worth around $215,000, and 1,906.67 PAXG, its gold-backed token, valued at approximately $5.3 million. StraitsX froze 819,820.54 XUSD, valued at about $820,000.
Binance also used administrator controls connected to WBETH, its wrapped liquid-staking Ether token, to freeze 29,934.01 WBETH linked to Binance 14. The reported value of that balance was between $80 million and $100 million. The restriction prevents the holder from unstaking or selling the tokens through their intended mechanisms.
The actions underline a practical division among assets caught in a major exploit. Centralized stablecoins, wrapped tokens and some issuer-managed assets can be frozen quickly if the issuer identifies the relevant addresses. Native coins such as BTC and ETH operate differently: their networks validate transfers, but no issuer can blacklist an address or reverse a completed transaction.
Arbitrum moved seized tokens into a controlled wallet
Arbitrum's Security Council said it transferred 74,559,805 ARB and 8,425 ETH from an address linked to the incident into a transit freezing wallet at 8:19 Beijing time.
According to the council, the original address can no longer access the funds. Any further movement would require action by the Security Council or a governance vote by the Arbitrum DAO.
That intervention reflects the governance powers available on some newer blockchain networks and token ecosystems. While the assets were on-chain, control over their next transfer was moved from the suspected attacker to a body authorized under Arbitrum's security framework.
Native Bitcoin and Ether remain in focus
Tracking has now shifted toward the stolen assets that lack issuer-level freeze controls. The remaining wallets reportedly include about 195,000 ETH and 18,270 BTC.
Part of the Ether has reportedly been deposited into Aave, a decentralized lending protocol, to borrow WETH. WETH is a tokenized version of Ether commonly used in decentralized finance applications. Borrowing against deposited ETH could allow a holder to obtain another transferable asset without immediately selling the original collateral, although the position remains subject to Aave's lending rules and liquidation mechanisms.
The reported use of Aave means monitoring will extend beyond spot-market transfers. Analysts following the addresses will also watch collateral positions, borrowed assets and any movement toward decentralized exchanges, bridges or centralized conversion points.
Chainalysis said in its latest crypto crime reporting that cybercriminals stole more than $3.4 billion in digital assets during the previous year. The scale of the Binance incident, if the company's reported outflow figure is sustained by subsequent evidence, would place it among the most consequential security events the sector has faced.
The freeze actions also show the limits of treating all on-chain assets as equally resistant to intervention. Holders of USDT, USDC and other centrally issued tokens rely partly on the issuer's ability to enforce contractual and technical controls. Bitcoin's and Ether's native transfer systems offer no comparable emergency freeze mechanism, leaving law enforcement, custodians, exchanges and on-chain tracing as the main avenues for constraining stolen funds.
Want deeper insight into asset safety after hacks? Explore how wallet choices shape your crypto security strategy today.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
