Over $3 billion in stolen crypto freezes

BTC----

A coordinated response involving stablecoin issuers, U.S. law enforcement agencies, blockchain analytics companies, networks and trading platforms froze or seized roughly $2.8 billion to $3 billion in crypto assets linked to the reported $6.3 billion Binance theft within days of the attack, according to Chainalysis and Elliptic.

The response concentrated on stablecoins, where issuers can blacklist addresses and stop transfers. Tether froze more than 1.567 billion USDT, while Circle blocked about $823 million in USDC, putting more than $2.3 billion of the stolen stablecoin holdings out of the attacker's reach. Elliptic said the frozen or seized amount it had verified reached about $2.85 billion, against estimated total losses of $6.43 billion.

The scale of the intervention reflects how recovery efforts increasingly depend on rapid coordination across public blockchains rather than on a single company's internal controls. Much of the remaining stolen crypto consisted of assets such as ETH and BTC, which lack an issuer able to freeze balances directly.

Stablecoin issuers moved within minutes

Tether's action accounted for the largest portion of the frozen assets. The company blocked transfers involving more than 1.567 billion USDT after funds reached what blockchain tracing identified as the attacker's main Ethereum wallet. Initial reports identified a freeze of roughly 1.18 billion USDT, followed 17 minutes later by a second action affecting four attacker-linked addresses.

Circle froze more than $800 million in USDC connected to the same incident, with the reported total reaching approximately $823 million. The USDC action followed Tether's first freeze by about three minutes and was coordinated with law enforcement, according to the material provided.

Together, the USDT and USDC freezes covered around 94% of the stablecoins identified among the stolen assets, concentrated largely on Ethereum and TRON. The result demonstrates the practical limits facing attackers who steal centrally issued stablecoins: they may control private keys, but transferability can disappear once an issuer blacklists a wallet.

FBI attributes operation to TraderTraitor

The FBI's cybercrime unit attributed the theft to a North Korean group operating under the TraderTraitor label in a public notice dated October 31. The bureau identified more than 600 Ethereum addresses, nearly 20 Bitcoin addresses and one Solana address as connected to the activity.

Following the attribution, the FBI, U.S. Secret Service and IRS Criminal Investigation called on infrastructure providers and crypto businesses to block transactions associated with the listed wallets and any related addresses. The request covered THORChain nodes, remote procedure call, or RPC, operators, instant-swap services, DeFi protocols, blockchain analytics firms and virtual asset service providers.

The U.S. Secret Service said it had engaged industry participants within minutes of the incident. It also said federal prosecutors in Washington, D.C., and the Central District of California were involved alongside Justice Department components.

North Korean hacking operations have repeatedly relied on rapid asset swaps, bridge transactions and a large number of newly created wallets to make tracing harder. In this case, the speed of the first freezes appears to have prevented a substantial share of the stablecoin balance from moving through that process.

Tracing expanded from hundreds to thousands of wallets

Blockchain intelligence firms Elliptic, Chainalysis, TRM Labs and SlowMist compiled address data and monitored the movement of the stolen assets. Elliptic published a downloadable blacklist that grew from hundreds of addresses to thousands, and later tens of thousands, as investigators followed transactions through new wallets.

Chainalysis reported that about $2.8 billion had been frozen by approximately 11:30 a.m. Eastern Time on November 3. The firm said investigators shared leads with industry partners to identify and block assets, while warning that the attacker's use of thousands of addresses could expand into tens of thousands over subsequent weeks.

TRM Labs said it had high confidence in the TraderTraitor attribution, citing patterns it compared with the 2025 Bybit breach and the April 2026 KelpDAO case. SlowMist described an attack sequence involving EIP-7702, an Ethereum standard that can allow an externally owned account to temporarily use smart-contract code. According to SlowMist, the attacker rehearsed for hours before using the technique in a batch theft targeting hot-wallet tokens.

The reported attack would rank as the largest crypto theft on record, exceeding the approximately $1.5 billion stolen from Bybit in February 2025 by more than four times. The comparison also shows how much larger the operational challenge becomes when attackers begin with billions of dollars spread across several chains and asset types.

Networks used emergency governance powers

Arbitrum and Optimism used governance-led emergency measures to move tokens from attacker-controlled addresses into freezing wallets. Arbitrum's security council transferred about 8,426 ETH and roughly 74.56 million ARB on October 30, assets valued at about $30.5 million in the provided material.

Optimism governance moved approximately 44 million OP, valued at roughly $5 million. These interventions totaled about $35 million and show that some layer-2 networks can act more directly than base-layer networks when governance structures authorize emergency controls.

World Liberty Financial separately froze assets linked to the attack, including about $27 million in USD1 and approximately $2 million worth of WLFI. The organization said it planned to work with BitGo on handling the affected assets.

Such measures can preserve assets during an active theft, but they also place emergency authority in the hands of security councils, governance voters or token issuers. That trade-off has become increasingly visible as networks design defenses against large-scale exploits.

DeFi protocols contained borrowed funds

The attacker also used stolen funds in decentralized finance before protocol-level restrictions were applied. On-chain data showed about 60 million USDT deposited into Aave V3, followed by borrowing of roughly 19,762 WETH, valued at about $44.6 million at the time.

Aave responded by pausing new deposits and borrowing across hundreds of DAO-operated market reserves on V3 and V4. Withdrawals, repayments and liquidations remained available, allowing users to reduce positions and maintain the health of existing markets while stopping new exposure linked to compromised collateral.

Centralized platforms including OKX, Coinbase and Bybit also participated in measures intended to intercept transfers from compromised wallets. The assets that remain movable present a more difficult recovery path, particularly if they reach over-the-counter desks, mixing services or exchange off-ramps before being identified.

The attacker was reported to retain control of about 420,000 ETH and 18,270 BTC, valued in the supplied material at roughly $2.4 billion. Unlike USDT, USDC and governance-controlled tokens, Bitcoin and Ether cannot be frozen by a token issuer. Their recovery would depend on tracing, asset seizures, or identifying a point where the funds enter a regulated service willing or required to act.