Independent record. Not associated with, endorsed by or operated by Binance. This site is read-only: there is nothing to sign in to, pay for or connect.
An independent record of the October 2026 Binance hack
Statements
Each statement is one attributed line with a verbatim quote from a stored copy of the source. Only approved statements are shown.
Official means the party said it, not that it is true.
Verified on-chain. Reproduced by us from raw chain data kept in our own storage. The method is shown.
Official. Stated by the party concerned (an exchange, an agency, a token issuer or similar), attributed to them. Official means the party said it, not that it is true.
Reported. Stated by news media or an analytics firm, attributed to them.
Disputed. Credible sources conflict. The statement links the sources that disagree.
Debunked. Contradicted by primary evidence, which is linked.
Theory. Speculation, attributed to whoever proposed it, shown with the evidence for and against.
The issuers froze about 2.8 billion dollars, and most of it within 47 minutes of the main sweep, but the attacker had moved 700 million USDT out of the hub before the first freeze landed and converted close to 800 million dollars of stablecoins into assets nobody can freeze.
Worked with law enforcement, blockchain intelligence firms, asset issuers and industry partners to trace and freeze affected assets. Approximately $3 billion has been frozen on-chain to date.
Circle CEO Jeremy Allaire said the company had frozen more than $800 million in USDC in coordination with law enforcement and would continue supporting the investigation.
Stablecoin issuers began freezing funds 56 minutes after the first transfer. Tether acted first, at 21:01, about 37 minutes after the big Ethereum transaction, and Circle followed three minutes later. Binance suspended deposits and withdrawals that night and published a written update at 02:23 UTC, a little over six hours after the first transfer.
Stablecoins make up 94% of the frozen funds, almost entirely on Ethereum and Tron. Arbitrum and Optimism are the only blockchains where everything stolen has been secured, in both cases by the network's own governance. Nothing stolen on Bitcoin, the XRP Ledger, Solana or NEAR has been frozen, because native assets have no issuer that can freeze them.
The Arbitrum Security Council took emergency action to move assets out of the attacker's reach, and on October 31 Optimism's governance appears to have done the same, moving 44 million OP (around $5 million) out of the attacker's address.
Elliptic has verified $2.85 billion of frozen or seized funds, 44% of the theft, almost all of it USDT and USDC. The attacker is swapping the rest into ETH and other assets that cannot be frozen, and moving funds between blockchains, using automated scripts that run around the clock.
The second batch reduced borrow caps and draw caps on the largest borrow paths to about 2% above the amount borrowed just before the exploit. This removes about $3.7B of unused borrow capacity on Aave V3 and $130M on Aave V4, which would otherwise have become available all at once when markets reopen. Every reserve can still return to its pre-exploit borrow size. The GHO borrow cap reductions on Aave V3 Core and Prime were queued with the GHO Stewards.
Tether and Circle froze about $1.8B in the main collection address within 40 minutes, and with later freezes by other issuers and the Arbitrum Security Council, Binance puts the verified total frozen at about $3B.
Elliptic’s Robinson says that around $2.8 billion, or around 44 percent of the total amount stolen, has been frozen by crypto companies and exchanges so far, with almost all of this being stablecoins.
Tether and Circle used it, locking up about $2.39 billion between them. That’s 43% of the haul. That leaves somewhere between $2.6 and $3.2 billion still out there.
Issuers had frozen $2.80 billion of it, but $2.9 billion in Ethereum Ethereum, Bitcoin Bitcoin, Tron , Solana and other tokens could still be moved, according to Arkham.
Binance has said the attack began with a compromised employee laptop and involved multiple breach points. It found no evidence of private-key leakage and said roughly $3bn of affected assets had been frozen.
Tether, Circle, Ripple and World Liberty Financial froze about USD 2.67 billion in stablecoins, and Arbitrum's Security Council froze 8,426 ETH and 74.6 million ARB on its network, for a total of roughly USD 2.7 billion.
Elliptic estimated that $2.84 billion had been frozen by 7:00 am UTC on Friday, while the attackers still controlled around $3.33 billion in assets that issuers could not immobilize.