An Odaily report published on November 6, 2026, at 18:15:33 UTC+8, by Wenser, described the response to an approximately $6.3 billion Binance asset theft. Its account placed stablecoin issuers, law enforcement, blockchain investigators, network governance bodies and exchanges at different points in the effort to restrict stolen funds.
The distinctions matter: blocking token transfers, moving assets out of an attacker’s control, restricting lending markets and returning funds to Binance are separate actions. The figures below are those reported by Odaily, with differing estimates and reporting cutoffs—not independently established recovery totals.
Stablecoin issuers: transfer restrictions, not completed repayment
Tether: According to the report, CEO Paolo Ardoino said Tether helped freeze more than 1.567 billion USDT potentially connected to the theft. Odaily cited media accounts saying approximately 1.18 billion USDT was frozen about 37 minutes after stolen USDT reached the attacker’s main Ethereum wallet, followed by freezes affecting four attacker addresses within another 17 minutes.
Those restrictions prevented USDT from being transferred onward; they did not mean Binance had recovered the corresponding funds.
Circle: Odaily put Circle’s frozen amount at approximately $823 million. It cited CEO Jeremy Allaire as publicly confirming more than $800 million in USDC frozen in coordination with law enforcement. The report said Circle acted three minutes after Tether.
Together, the two issuers accounted for more than $2.3 billion of an approximately $3 billion frozen-asset total cited by Odaily. The article said USDT and USDC represented about 94% of the stolen stablecoins, almost entirely on Ethereum and Tron.
World Liberty Financial: Binance co-founder and co-CEO He Yi reportedly disclosed freezes of approximately $27 million in USD1 and $2 million worth of WLFI. WLFI co-founder Zach Witkoff confirmed freezing steps and said the project would work with BitGo on the stolen tokens. Odaily also reported freeze assistance involving Ripple’s RLUSD, Paxos and First Digital, without providing amounts.
Law enforcement and investigators: attribution and tracing
Odaily reported that the FBI’s cybercrime division issued an October 31 notice attributing the theft of more than $6 billion in Binance virtual assets to North Korean hackers associated with TraderTraitor.
The published address information reportedly covered more than 600 Ethereum addresses, nearly 20 Bitcoin addresses and one Solana address. The FBI, Secret Service and IRS-CI called on THORChain nodes, RPC operators, instant exchanges, DeFi services, analytics firms and virtual-asset service providers to block related transactions and downstream flows.
The Secret Service said it had worked with industry participants within minutes of the incident to identify and freeze a substantial portion of the funds, alongside a broader federal investigation.
Odaily also described several private-sector tracing efforts:
- Elliptic estimated losses at approximately $6.43 billion and verified about $2.85 billion as frozen or seized. It published a downloadable address blacklist that subsequently expanded to thousands and eventually tens of thousands of addresses, and said its alerts had prompted some freezes.
- Chainalysis reported approximately $2.8 billion frozen as of November 3 at about 11:30 a.m. ET. It said investigators shared leads with industry partners and linked laundering flows to funds stolen from Bitget the previous month. CEO Jonathan Levin warned that thousands of attacker addresses could expand into tens of thousands over the following weeks.
- TRM Labs expressed high confidence in a TraderTraitor attribution, comparing the methods with the 2025 Bybit and April 2026 KelpDAO incidents.
- SlowMist founder Yu Xian described alleged use of EIP-7702 to batch-transfer hot-wallet tokens after hours of rehearsal. Odaily also noted that an earlier investigative suggestion from SlowMist’s 23pds—examining private-key leakage and abnormal withdrawal tools—did not fully match what the article described as the actual cause.
These totals have different scopes and cutoffs and should not be added together as separate recoveries.
L2 governance: moving assets beyond attacker control
According to Odaily, the Arbitrum Security Council took emergency action on October 30, moving approximately 8,426 ETH and 74.56 million ARB, valued together at about $30.5 million, into an intermediary frozen address.
Arbitrum said only the Security Council or an Arbitrum DAO governance vote could authorize further movement, and that other users and applications were unaffected.
On Optimism, governance-side action reportedly moved approximately 44 million OP, worth about $5 million, out of attacker addresses for protection.
Odaily said Binance had submitted governance proposals seeking the return of these assets, with the process potentially taking weeks. Removing attacker control was therefore not the same as completing restitution.
Aave: restricting further borrowing, not reclaiming borrowed ETH
The report cited on-chain data showing that the attacker deposited approximately 60 million USDT into Ethereum Aave V3 and borrowed about 19,762 WETH, then worth approximately $44.6 million.
Aave subsequently froze new deposits and borrowing across hundreds of DAO-operated V3 and V4 market reserves, while withdrawals, repayments and liquidations remained available. Founder Stani Kulechov said contracts were unaffected and the position remained overcollateralized.
The intervention limited further leverage or position changes. Odaily explicitly noted that the ETH already borrowed remained under attacker control.
Exchanges: interception and coordination
Coinbase CEO Brian Armstrong said his team was offering support, including blocking transfers to compromised wallets, and had contacted Binance. Bybit CEO Ben Zhou said Bybit was unaffected, with trading and withdrawals operating normally, and offered assistance.
OKX CEO Star called for shared exchange security standards and coordinated incident response. His proposals included additional checks and security delays for large withdrawals to unfamiliar addresses and smart-contract approvals, signing-layer restrictions, real-time incident notifications and joint monitoring of suspicious funds.
The unresolved obligation chain
Odaily’s account describes several forms of intervention, but none should be treated as interchangeable proof of customer repayment or exchange solvency. Issuer freezes restrict token movement; governance actions change who can move particular assets; lending restrictions limit further protocol activity.
At the report’s publication, the remaining recovery question was whether unfrozen funds could be intercepted at OTC channels, mixers and exchange exits—and ultimately returned.
Original source: Odaily, by Wenser, November 6, 2026.