Overview As of 08:30 UTC on October 30, 2026, about $3 billion of the assets taken from Binance has been frozen, and nothing at all has been returned to the exchange or to user balances. The distance Overview As of 08:30 UTC on October 30, 2026, about $3 billion of the assets taken from Binance has been frozen, and nothing at all has been returned to the exchange or to user balances. The distance
Binance's Frozen $3.0B: Why Freezing Doesn't Mean Recovery & The Real Net Loss
Overview
As of 08:30 UTC on October 30, 2026, about $3 billion of the assets taken from Binance has been frozen, and nothing at all has been returned to the exchange or to user balances. The distance between those two numbers is not a reporting lag. Freezing is a unilateral act by a stablecoin issuer, while returning the funds requires destroying the original tokens and minting replacements, and in civil cases that second step typically arrives months after the first.
Of the $6.36 billion moved out, only centrally issued stablecoins were ever eligible for a freeze. TRM Labs counted 18,270 BTC, about 233 million XRP and 970,500 SOL among the stolen assets, together worth about $1.862 billion, or 29.3% of the total, with no issuer-level freeze path of any kind. Asset type set the ceiling on what could be salvaged, and that is the point most easily buried under the headline figures.
Key Takeaways
Item | Detail |
Total moved out | About $6.36 billion at the time of transfer, per TRM Labs on October 29 |
Frozen, per Binance | About $3 billion at 00:52 UTC on October 30, not broken down by asset |
Frozen, verifiable on-chain | About $2.7 billion, per TRM Labs as of 00:30 UTC on October 30 |
Returned to the exchange or users | No public record as of 08:30 UTC on October 30 |
Still under the attacker's control | About $2.4 billion, including 18,270 BTC and more than 420,000 ETH |
Stablecoins as a share of the total | About $3.4 billion, roughly 53.5% |
Share of stolen stablecoins frozen | About $2.64 billion, roughly 77.6% |
Assets with no issuer freeze path | BTC, XRP and SOL, about $1.862 billion, 29.3% of the total |
Who bears the loss | Binance says the SAFU fund and company funds will cover all losses |
Three Numbers That Measure Different Things
Most of the figures circulating about this incident arrive without a stated basis. Moved out, frozen, returned, and still with the attacker are four separate quantities, and only the first two have published numbers.
Basis | What it measures | Amount | Source and timestamp |
Moved out | Assets sent from Binance wallets to attacker-controlled addresses | About $6.36 billion | TRM Labs, October 29 |
Frozen, exchange figure | Assets an issuer has restricted from moving | About $3 billion | Binance, 00:52 UTC October 30 |
Frozen, on-chain verified | Freezes that can be checked transaction by transaction | About $2.7 billion | TRM Labs, 00:30 UTC October 30 |
Returned | Reissued or transferred by court order back onto the exchange's or users' books | No public record | As of 08:30 UTC October 30 |
Still with the attacker | Not frozen and freely transferable | About $2.4 billion | TRM Labs, 00:30 UTC October 30 |
Binance's $3 billion and TRM Labs' $2.7 billion differ by about $300 million. Binance has not disclosed how its total breaks down by asset, while TRM Labs' figure is an itemized on-chain count, so in practice $2.7 billion is the verifiable floor and $3 billion is the exchange's self-reported total. The two are not in conflict; they carry different degrees of verification.
Frozen assets sit on an issuer's contract blacklist. The attacker cannot move them, and they have not entered Binance's or any user's balance. In accounting terms they remain a loss, one that now has a possible route to recovery.
The Money, Broken Down by Asset and Chain
Stablecoins
Stablecoins were the only asset class actually frozen in this incident. The amounts below come from TRM Labs' count as of 00:30 UTC on October 30.
Asset | Moved out | Frozen | Share frozen |
USDT | About $2.488 billion | About $1.773 billion | About 71% |
USDC | About $823 million | About $825 million | Effectively all of it |
RLUSD | About $88.5 million | About $40.5 million | About 46% |
USD1 | Not published | About $27.8 million | Not calculable |
The frozen USDC figure slightly exceeds the amount taken because the two come from different counts, Circle's own statement and an on-chain tally, so dividing one by the other produces no meaningful ratio. What is clear is that essentially all of the USDC was frozen, which comes down to timing: Tether completed its first freeze 37 minutes after the main sweep and Circle acted three minutes later, before the stolen USDC had begun to move.
USDT was frozen at a lower rate because the attacker had already converted a large share of it. Bitquery counted $729 million of USDT swapped into other assets before the freezes landed, equal to 29.3% of the USDT taken. TRM Labs recorded about 325 million of that USDT sold to market makers at a discount of more than 10% for roughly 122,300 ETH, which works out to about 2,657 USDT per ETH on those two figures. RLUSD was frozen at the lowest rate, with the attacker selling 48 million on decentralized exchanges between 21:42 and 22:01 UTC on October 29.
On Ripple, Binance co-CEO Yi He put the freeze at about $200 million on the night of the incident, while the on-chain verifiable RLUSD freeze stands at $40.5 million. That gap is one of the main sources of the difference between the exchange's self-reported total and the on-chain count.
The assets that could not be frozen
Asset | Moved out | Frozen | Issuer-level freeze possible |
BTC | 18,270 coins, about $1.47 billion | None | No |
XRP | About 233 million, about $296 million | None | No |
SOL | 970,500 coins, about $96 million | None | No |
The ability to freeze comes from an issuer's control over a token contract. Stablecoins are minted by an issuer whose contract retains a function for blacklisting an address, and the issuer can call it unilaterally. Bitcoin has no issuer and no administrator key, so there is no contract-level switch to call. XRP needs a distinction drawn: the XRP Ledger's clawback feature applies only to tokens issued by an issuer on the ledger, not to XRP itself as the native asset. The same reasoning applies to SOL.
Recovery for these three therefore depends on tracing and on blocking deposits at cooperating exchanges and services, with no issuer-level route available. The Arbitrum Security Council's forced transfer of 8,426 ETH and 74.6 million ARB out of the attacker's wallet was a special intervention by an on-chain governance body, and no equivalent mechanism exists on Ethereum mainnet.
Why Frozen Does Not Mean Returned
Freezing and destruction are separate steps
Taking USDT as the example, the blacklist function and the destroy function in the issuer's contract are distinct. The blacklist function sets a flag that stops the address from moving USDT; the balance remains on-chain and is immobilized rather than removed. The destroy function requires the address to already be blacklisted, and when executed it zeroes that balance and reduces total supply accordingly, with no way to undo it.
Getting the value back to its rightful owner takes two steps: destroy the balance at the blacklisted address, then mint an equivalent amount of new tokens to a court-designated or victim address. Total supply returns to its previous level, but the original tokens no longer exist. An ordinary transfer cannot achieve this because the victim does not hold the private key to the frozen address. As BlockSec describes it, the value reaches victims through the court rather than directly.
What is required, and who executes it
Step | Executed by | Required basis | Typical duration |
Freeze | The issuer, at its own discretion | No court order needed | Minutes to hours after a law enforcement request |
Destroy and reissue | Only the issuer's multisig, on-chain | A civil forfeiture court order, an OFAC designation, or an issuer-verified victim petition supported by tracing evidence | Usually months after the freeze in civil cases, faster in criminal ones |
The decisive detail is that only the issuer's multisig can perform the destruction and reissuance on-chain. No court, regulator or exchange can trigger it directly, and even where the underlying authority is a government agency, the on-chain actor of record remains the issuer. Tether's victim recovery policy accepts claims above $1,000, charges a fee of up to 10% of the amount with a $1,000 minimum, and leaves acceptance to its own discretion.
Historical timing and proportions
BlockSec counted about $698 million of USDT destroyed across 2025 against about $1.26 billion blacklisted in the same year, putting the first at roughly 55.6% of the second. That is a ratio between two annual flows and cannot be read as 55.6% of any given batch of frozen assets reaching its owner, because case processing between freeze and destruction runs 6 to 18 months, so a year's destruction volume corresponds to freezes from earlier years.
The closer comparison is the Bybit incident of February 2025. That theft totaled about $1.5 billion, of which $48.4 million made it back to the platform, equal to 3.2%, over a period of months. A far larger share has been frozen this time and the freezes landed sooner, but moving from blacklist status to an actual return still requires every step above.
Where the Net Loss Stands, and Who Carries It
No definitive net loss figure is available, but both ends of the range can be stated. If the full $3 billion frozen were destroyed, reissued and returned, the net loss would be about $3.3 billion. If the return rate resembled the Bybit outcome, the net loss would approach the full amount taken. Which end it lands near depends on the progress of judicial proceedings and on each issuer's handling decisions, and no party has given a timetable.
For users, the range matters less than it might appear. Binance has said the SAFU fund and company funds will cover all losses and that user assets are safe, which means the return rate affects Binance's balance sheet rather than anyone's account balance. Binance has also said it will update its proof of reserves data after remediation and publish a full technical post-mortem, and those two documents are the most direct basis for checking the net loss and how the shortfall was made up. As of 08:30 UTC on October 30, neither has been released.
A Practical Question When Reviewing Where Assets Sit
Nothing in this incident changed any user’s account balance. What affected people was the withdrawal suspension, and the longer an interruption runs, the more holders reconsider whether keeping everything in one venue suits them.
The obstacle to spreading holdings is rarely the fee schedule. It comes down to two narrower questions: whether the destination supports the tokens held, and whether those tokens can be used for futures and Earn once they arrive. The first can be settled in advance, and MEXC’s asset support checker reads the tokens from an uploaded holdings screenshot and returns their status across Spot, Futures and Earn, with no login, no account permissions requested, and no screenshot kept after recognition. The second depends on prevailing rates, and the terms of the MEXC Earn Carnival remain within their campaign window. What comes back is reference material; whether and how to move anything stays with the user.
Exclusive View from James Mitchell
This incident will reprice the word frozen within the industry's vocabulary. For several years, issuer freezes have been described as a safety net, and funds reported as frozen have routinely been counted as recovered. This event lays the intervening procedure out in full: a freeze is a unilateral, minutes-scale act by an issuer, while destruction and reissuance is a months-scale act requiring a judicial basis, and between them sits a gate that neither the exchange nor the issuer controls alone. The coexistence of $2.7 billion in verified freezes and zero returns is not slow progress; it is how the process works.
The conclusion with more lasting weight concerns asset composition. Stablecoins made up 53.5% of the $6.36 billion taken, and freezes covered 77.6% of them. BTC, XRP and SOL together accounted for $1.862 billion, with freeze coverage of zero. The attacker converted $729 million of USDT into other assets before the freezes landed, accepting a discount of more than 10% to do it, and in hindsight that was a rational trade, because it exchanged freezable assets for unfreezable ones. Hot wallet composition is therefore not only a liquidity decision; it sets the ceiling on what can be salvaged after an attack. Exchanges weighing hot wallet allocation have historically traded off withdrawal throughput against funding cost, and this layer now belongs in that calculation.
For an ordinary user the usable conclusion is narrow but clear: judge the impact of an incident by the exchange's compensation commitment and its subsequent proof of reserves update, not by the rolling frozen total. A rising frozen figure shows that tracing and coordination are working, but it is not money in anyone's account, and it is not yet money on Binance's books either.
FAQ
How much was ultimately lost in the Binance hack?
That cannot yet be determined. About $6.36 billion was moved out, of which about $3 billion has been frozen, and as of 08:30 UTC on October 30 nothing has been returned. If the frozen portion were returned in full, the net loss would be about $3.3 billion; if the return rate resembled the Bybit outcome of 3.2%, it would approach the full amount. Binance has said the SAFU fund and company funds will cover all losses.
Does frozen money count as recovered?
No. A freeze means an issuer has placed assets on a contract blacklist so they cannot be moved, but they remain at the original address and have not entered Binance's or any user's balance. A return requires the issuer first to destroy the balance at the blacklisted address, then mint an equivalent amount to a court-designated or victim address.
Why was no Bitcoin frozen?
The ability to freeze comes from an issuer's control over a token contract. Stablecoins are minted by issuers whose contracts retain a blacklist function, while Bitcoin has no issuer and no administrator key, so no contract-level switch exists. The same applies to XRP and SOL, and the XRP Ledger's clawback feature covers only tokens issued on the ledger, not native XRP.
How long does it take for frozen assets to be returned?
BlockSec puts case processing between freeze and destruction at 6 to 18 months, with civil forfeiture cases usually completing months after the freeze and criminal cases moving faster. In the February 2025 Bybit incident, $48.4 million returned to the platform over a period of months. This incident has not yet reached that stage.
Who decides where frozen assets go?
The on-chain action can only be executed by the issuer's multisig, and no court, regulator or exchange can trigger it directly. The destruction nonetheless requires a legal basis, whether a civil forfeiture court order, an OFAC designation, or an issuer-verified victim petition supported by tracing evidence. The recipient is therefore determined by judicial process, with the issuer carrying out the execution.
How much did Tether and Circle each freeze?
Per TRM Labs as of 00:30 UTC on October 30, Tether froze about 1.773 billion USDT and Circle about 825 million USDC. Ripple froze 40.5 million RLUSD and World Liberty Financial 27.8 million USD1. Binance's self-reported total of about $3 billion is not broken down by asset.
Why do the reported frozen totals differ?
They differ in verification and in timing. Binance's $3 billion is a self-reported total with no published composition, while TRM Labs' $2.7 billion is an itemized count verifiable on-chain, taken twenty-two minutes earlier. Binance also cited a Ripple freeze of about $200 million against $40.5 million of RLUSD verifiable on-chain, which is one of the main sources of the difference.
Do users need to file their own recovery claims?
No. The assets taken in this incident came from Binance's hot wallets, so the claimant is Binance rather than any individual user. Binance has said it will cover all losses, and user balances do not move with the progress of any return.
Disclaimer
This article is for general information only and does not constitute investment, financial, legal or tax advice. Figures are current as of 08:30 UTC on October 30, 2026, and the incident and the related judicial proceedings are still in progress, so amounts and the status of any return may change with subsequent official disclosures. Crypto assets are highly volatile and can produce losses exceeding the initial outlay. Readers should verify the original disclosures and judge independently, consulting a qualified professional where appropriate.
About the Author
James Mitchell specializes in technical analysis, market trends, and trading strategies for both Bitcoin and altcoins. Based in London, he has over 10 years of experience in financial markets. Before joining MEXC Learn, James worked as a senior analyst at a leading European investment firm, where he developed expertise in risk management and quantitative trading. His transition to cryptocurrency markets began in 2017, and he has since become recognized for his data-driven approach. He holds a Master's degree in Financial Economics from the London School of Economics. His analytical approach combines traditional technical analysis with on-chain metrics to provide readers with actionable insights.
Areas of Expertise: Technical Analysis, Market Trends and Cycles, Trading Strategies, Bitcoin and Altcoin Analysis, Risk Management.
Research References
Want the fastest access to MEXC's latest updates? Join our official Telegram group now!
Account Verification: Understand KYC | How to Complete KYC
Market Opportunity
Notcoin Price(NOT)
$0.0003544
$0.0003544$0.0003544
USD
Notcoin (NOT) Live Price Chart
The articles shared on this page are sourced from public platforms and are provided for reference only. They do not represent the position or views of MEXC. All rights belong to James Mitchell. If you believe any content infringes upon the rights of a third party, please contact [email protected] for prompt removal. MEXC does not guarantee the accuracy, completeness, or timeliness of any content and is not responsible for any actions taken based on the information provided. The content does not constitute financial, legal, or other professional advice, nor should it be interpreted as a recommendation or endorsement by MEXC. For expert insights and in-depth analysis, visit MEXC Learn.
Latest Updates on Notcoin
View More
JPM Coin Ethereum: Are Bank Deposits Moving Onchain?
J.P. Morgan has brought JPM Coin, ticker JPMD, to the Ethereum mainnet, extending its USD-denominated deposit token to a second public blockchain after launching it on Base. The October 19, 2026 expansion matters because JPMD is not a conventional stablecoin. It represents a U.S. dollar deposit at J.P. Morgan and remains available to eligible institutional clients rather than the general public
2026/10/20
Does the Binance Security Incident Put Your Ethereum Wallet at Risk? EIP-7702 and Wallet Delegation Explained
The Binance security incident on October 30, 2026 has pushed a relatively technical Ethereum feature into a much broader security discussion: EIP-7702 wallet delegation.
For ordinary Ethereum users, however, the most important question is not whether EIP-7702 appeared somewhere in the incident timeline. It is whether the same class of authorization risk could affect a personal wallet holding ETH, USDT, USDC or other Ethereum assets
2026/10/30
What Role Did EIP-7702 Authorizations Play in the Binance Hack?
That detail quickly pushed EIP-7702 into the center of the discussion. The Ethereum account-delegation mechanism allows a normal externally owned account, or EOA, to temporarily execute smart contract logic. In the Binance incident, blockchain researchers identified an EIP-7702 delegation shortly before assets were transferred from a Binance-linked hot wallet.
But there is an important distinction
2026/10/30
You May Also Like
HOT
Currently trending cryptocurrencies that are gaining significant market attention
Crypto Prices
The cryptocurrencies with the highest trading volume
Newly Added
Recently listed cryptocurrencies that are available for trading