Circle, Tether Freeze More Than $2B After $6.4B Binance Hack

Circle froze about $823 million in USDC, and Tether said it froze more than $1.567 billion in USDT within hours of attackers taking roughly $6.4 billion from Binance in an Oct. 30, 2026 breach, as the Federal Bureau of Investigation and U.S. Secret Service reportedly joined the response.

Tether CEO Paolo Ardoino posted late on Oct. 29, before Binance published its detailed account on Oct. 30: “Tether froze more than 1.567B USDT related to a potential Binance exchange hack. Protecting the industry and our partners is our main priority. Stay safe everyone.”

The sequence meant issuers were blacklisting addresses while Binance was still confirming what had happened.

Circle and Tether’s actions, combined with freezes by other blockchain partners, immobilized about $2.4 billion of the stolen funds. Binance says roughly $3 billion is frozen on-chain, a broader figure that includes assets beyond the two stablecoins.

How do issuer freezes work?

USDC and USDT are contract tokens whose issuers control a blacklist. Once an issuer adds an address, it blocks transfers to or from that address across every wallet and exchange that honors the token. A stolen USDC balance therefore remains a claim that Circle can switch off, not money with unrestricted transferability.

For stablecoin markets, that central control turns the issuer blacklist into an immediate enforcement and recovery mechanism across otherwise separate venues.

What do the recovery figures show?

Three figures describe the recovery, based on issuer actions, other blockchain partners and Binance’s on-chain accounting:

• $2.4 billion: The amount immobilized by the issuers and other blockchain partners.
• $3 billion: Binance’s broader on-chain freeze total, including assets beyond USDC and USDT.
• $3 billion to $4 billion: The estimated unrecovered loss range after the rapid freezes.

Security researchers cited in the report said that without rapid intervention, the majority of funds stolen by state-sponsored groups is never recovered.

The Tether total remains unsettled: Ardoino said more than $1.567 billion, while some reports put it at $975.1 million. The two accounts have not been reconciled.

What do investigators say caused the breach?

Binance said it engaged law enforcement and blockchain intelligence partners to trace and recover funds.

Binance stated: “Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak.”

The exchange placed the failure in its infrastructure rather than in a smart contract.

The FBI said it was aware of the incident and was working with public and private partners to coordinate investigative steps. The U.S. Secret Service has not commented on its role.

Who linked the attack to TraderTraitor?

TRM Labs, Elliptic and Chainalysis have each attributed the attack to TraderTraitor, a North Korean hacking group previously linked to the $1.5 billion Bybit theft. Neither Binance nor law enforcement has publicly made that attribution, leaving TraderTraitor as an analytical finding rather than an official determination.

Security researchers have also examined whether the drain occurred through delegated wallet permissions.

When can Binance resume withdrawals?

Binance said it will cover all losses from its SAFU fund and company funds and that user funds are safe. Deposits and withdrawals remain suspended while security checks continue, with the exchange targeting a withdrawal restart by Sunday, Nov. 1.

Sunday, Nov. 1 is the immediate operational deadline for Binance’s withdrawal restart, while the unresolved Tether amount leaves the recovery total less certain than the $3 billion on-chain figure suggests.