Nearly $2.8 Billion Linked to Binance Theft Frozen by Nov. 3

Nearly $2.8 billion tied to Binance's Oct. 30 hot-wallet theft had been frozen by Nov. 3, according to aggregated issuer and on-chain records. The figure stood at about $2.8 billion as of 11:30 a.m. ET Tuesday, Nov. 3 (16:30 UTC). A freeze blocks transfers. It does not by itself return funds to Binance.

The bulk sits with two stablecoin issuers. Tether froze more than 1.567 billion USDT tokens. Circle froze about $823 million in USD Coin, putting the two issuers' combined total above $2.39 billion. That concentration is the story's quiet headline: issuers, not exchanges, did most of the containment.

Who ordered the freeze?

On Oct. 31, the FBI attributed the theft of more than $6 billion in virtual assets to North Korean hacking group TraderTraitor. The FBI, the U.S. Secret Service and the IRS Criminal Investigation division jointly urged crypto services to block transactions linked to more than 600 addresses on Ethereum, close to 20 on Bitcoin and one on Solana. Blockchain-analytics firms Elliptic, Chainalysis, TRM Labs and SlowMist tracked the addresses and transfers. Chainalysis also linked some Binance-related funds to assets stolen from Bitget the previous month.

How did L2 governance respond?

Two layer-2 networks took direct action through their governance machinery.

• Arbitrum: its security committee moved assets worth about $30.5 million from an attacker-controlled address into a restricted wallet. Releasing them again requires committee action or an Arbitrum DAO vote.
• Optimism: governance moved about $5 million in assets out of an attacker address.
• Binance has sought the return of both pools through governance proposals, a process that may take weeks.

What does this change for recovered funds? In practice, frozen is not returned. Each pool now sits behind a governance or multisig gate, and Binance must work through those gates to claw anything back.

What about the DeFi leg?

World Liberty Financial froze about $27 million in USD1 and about $2 million worth of WLFI, according to Binance co-founder He Yi, with co-founder Zach Witkoff confirming the move.

Aave took the sharpest defensive step. The protocol paused new deposits and borrowing across hundreds of markets operated by its DAO after the attacker deposited about $60 million in USDT and borrowed roughly 19,762 WETH, then valued at $44.6 million. Withdrawals, repayments and liquidations stayed open. The borrowed WETH remains under the attacker's control — a gap between pausing a market and stopping an exit.

Which exchanges coordinated?

Industry response extended beyond issuers and DAOs. Coinbase offered help blocking transfers to compromised wallets and contacted Binance directly. Bybit CEO Ben Zhou offered support and said the exchange's systems, trading and withdrawals were operating normally. OKX CEO Star called for shared security standards and coordinated incident response among exchanges.

What happens to the unfrozen remainder?

The open question is interception. Assets still outside the freezes may move through over-the-counter channels, mixing services or exchanges, and each hop narrows the recovery window. The FBI's address list gives compliance teams a concrete watchlist, but enforcement now depends on whether downstream venues act on it before the funds fragment.

For Binance, the near-term milestones are procedural: the Aave pause holds until its DAO decides otherwise, and the Arbitrum and Optimism governance proposals work through voting timelines measured in weeks, not days.