Source publication time: November 6, 2026, at 22:30 UTC+8. The account below reflects the reporting available in the supplied article at that time.
A report by Wenser of Odaily, republished by PANews, described how stablecoin issuers, law-enforcement agencies, blockchain analysts, layer-2 networks and exchanges responded to a reported $6.3 billion theft from Binance. Roughly a week after the incident, the article put frozen assets at about $3 billion.
Those interventions were not equivalent. Issuers restricted token transfers; network governance bodies moved some assets out of attacker-controlled addresses; Aave restricted further activity in its markets; and exchanges offered interception and investigative support. Freezing funds did not, by itself, mean Binance had recovered them.
Stablecoin issuers restricted transfers
The report identified stablecoin issuers as the largest contributors to the frozen total:
- Tether: CEO Paolo Ardoino said the company had helped freeze more than 1.567 billion USDT potentially connected to the Binance theft. According to media coverage cited in the article, Tether initially froze about 1.18 billion USDT roughly 37 minutes after stolen USDT reached the attacker’s main Ethereum wallet, then froze four more attacker addresses within the following 17 minutes. These restrictions blocked outgoing USDT transfers; returning the corresponding funds still required further procedures.
- Circle: The article put its intervention at approximately $823 million. CEO Jeremy Allaire had publicly confirmed freezing more than $800 million in USDC linked to the incident and coordinating with law enforcement. The report said Circle acted three minutes after Tether.
- World Liberty Financial: Binance co-founder and co-CEO He Yi said WLFI froze approximately $27 million in USD1 and $2 million worth of WLFI. Co-founder Zach Witkoff confirmed freezing steps and said the project would work with BitGo to handle the stolen WLFI and USD1.
Together, Tether and Circle accounted for more than $2.3 billion of the roughly $3 billion frozen, according to the article. It said USDT and USDC represented approximately 94% of the stolen stablecoin assets, almost all on Ethereum and Tron. Ripple, in relation to RLUSD, as well as Paxos and First Digital, were also reported to have assisted with freezes of their respective stablecoins.
Law enforcement and analysts traced the funds
The article reported that, on October 31, the FBI attributed the theft of more than $6 billion in virtual assets from Binance to North Korean hackers operating under the designation TraderTraitor.
The FBI’s published address information reportedly covered more than 600 Ethereum addresses, nearly 20 Bitcoin addresses and one Solana address. The FBI, Secret Service and IRS-CI called on THORChain nodes, RPC operators, instant-swap providers, DeFi services, blockchain analytics companies and virtual-asset service providers to block transactions associated with, or derived from, those addresses.
The Secret Service said it had worked with industry participants within minutes of the incident to identify and freeze a substantial portion of the stolen funds. It also described a joint investigation involving federal prosecutors in Washington, D.C., and the Central District of California, alongside relevant Justice Department divisions.
The report separately summarized several analytics and security firms’ findings:
- Elliptic estimated the theft at approximately $6.43 billion and verified about $2.85 billion as frozen or seized. Its downloadable address blacklist expanded to thousands and eventually more than 10,000 addresses. The firm said its alerts had helped trigger some freezes.
- Chainalysis said investigators shared leads with industry partners to help identify and freeze funds. It reported approximately $2.8 billion frozen as of about 11:30 a.m. ET on November 3. The company also linked mixing activity involving the Binance proceeds to funds stolen from Bitget the previous month. CEO Jonathan Levin said the attackers had already used thousands of addresses and could expand to tens of thousands over the following weeks.
- TRM Labs attributed the attack to TraderTraitor with high confidence, comparing its methods with the 2025 Bybit incident and the April 2026 KelpDAO incident. The article also cited CNBC’s coverage of TRM’s observations about small Tornado Cash withdrawals, advance rehearsals and a burst of signing activity.
- SlowMist founder Yu Xian said the attackers used EIP-7702 to steal hot-wallet tokens in batches after rehearsing for several hours. SlowMist chief information security officer 23pds had earlier recommended investigating private-key leakage paths and abnormal withdrawal tools; the article acknowledged that this suggestion differed somewhat from what it described as the actual cause.
These figures came from different organizations and reporting cutoffs. They should not be added together as separate recovery totals.
Arbitrum and Optimism moved assets out of attacker control
The report described layer-2 interventions totaling roughly $35 million, distinct from issuer-level transfer freezes.
On October 30, the day of the reported theft, the Arbitrum Security Council carried out an emergency action transferring approximately 8,426 ETH and 74.56 million ARB from attacker addresses to an intermediate frozen address. The article valued the assets at about $30.5 million.
Arbitrum said only the Security Council or an Arbitrum DAO governance vote could subsequently move those funds, and that other users and applications were unaffected.
On Optimism, approximately 44 million OP, worth about $5 million, were reportedly moved out of an attacker address through governance-side action for protection.
At publication, Binance had submitted governance proposals seeking the return of these assets. The article said that process could take weeks: moving funds beyond the attacker’s control was not the same as completing their return to Binance.
Aave restricted new activity, rather than recovering the loan proceeds
According to on-chain data cited in the report, the attacker deposited approximately 60 million USDT into Ethereum Aave V3 and borrowed about 19,762 WETH, valued at roughly $44.6 million at the time.
Aave subsequently froze hundreds of DAO-operated market reserves across V3 and V4 as a precaution. New deposits and borrowing were suspended, while withdrawals, repayments and liquidations remained available.
Founder Stani Kulechov said the contracts were unaffected and the position remained overcollateralized. The intervention limited further use of stolen funds for leverage or position changes, but the ETH already borrowed remained under the attacker’s control.
Exchanges offered support and proposed tighter controls
Coinbase CEO Brian Armstrong said his team was providing support, including intercepting transfers to compromised wallets, and had contacted Binance to offer assistance.
Bybit founder and CEO Ben Zhou said Bybit was unaffected, its systems were operating normally, trading and withdrawals remained available, and customer assets were safe. He also offered support to Binance.
OKX founder and CEO Star called for common exchange-security standards and coordinated incident response. His proposals included additional verification and security delays for large withdrawals to unknown addresses and smart-contract approvals, safeguards at the signing layer, real-time incident notifications, joint monitoring of suspicious funds and rapid-response mechanisms. He also called for collaborative research into post-quantum cryptography and defenses against AI-related security threats.
Recovery remained unfinished
The source’s central distinction was between containing stolen assets and recovering them. Issuer freezes, governance-controlled transfers and lending restrictions addressed different parts of the attacker’s ability to move or use funds.
At the report’s publication, the remaining question was whether unfrozen assets could be intercepted through OTC channels, mixing services and exchange exits—and ultimately returned. The reported frozen balances did not establish that Binance had regained those assets or that the recovery process was complete.