- Trending
- Comments
- Latest
Tether says it froze more than $1.5 billion in USDT within 30 minutes of the October 29, 2026 Binance hack, but blockchain analytics firm Bitquery reports that about $729 million in stolen USDT moved beyond the issuer’s reach. Tether detailed its response in a November 2, 2026 statement, days after CEO Paolo Ardoino first announced the freeze on X on October 29, 2026.
Tether disclosed that it restricted access to more than $1.5 billion worth of USDT associated with the Binance hack shortly after the attack occurred on October 29.
The company said its response was initiated within approximately 30 minutes, preventing the affected funds from being moved beyond the reach of its intervention.
This was particularly significant because stolen cryptocurrency can be transferred across multiple blockchain networks, converted into other digital assets or routed through services designed to make transaction tracing more difficult.
Tether CEO Paolo Ardoino defended the company’s intervention, emphasizing that USDT’s centralized structure makes it possible to restrict suspicious wallet addresses when necessary.
“We have always said that USD₮ is the worst possible choice for criminals, and the Binance’ hack response shows why,” Ardoino said.
He further explained that the company had acted quickly to restrict the affected assets and protect the wider digital asset ecosystem.
The Binance hack response an important distinction between stablecoins such as USDT and decentralized cryptocurrencies.
Unlike Bitcoin, USDT is issued and administered by a centralized company, giving Tether the technical ability to blacklist specific wallet addresses and prevent transactions involving tokens held at those addresses.
The security incident became more serious after the FBI released an official alert on October 31, identifying North Korea as responsible for the theft of more than $6 billion in virtual assets from Binance.
The agency classified the operation under the name TraderTraitor, a designation associated with malicious cyber activities linked to North Korean actors.
According to the FBI, investigators observed the attackers converting much of the stolen cryptocurrency into Ethereum (ETH).
Authorities also warned that the funds could subsequently move through decentralized finance (DeFi) protocols and instant cryptocurrency swap services as part of efforts to conceal their origins.
The FBI urged cryptocurrency exchanges, blockchain infrastructure operators, decentralized finance platforms and other digital asset service providers to identify and block transactions associated with the wallets used in the operation.
Bo Hines, CEO of Tether USA₮, also highlighted the importance of the company’s response, describing the intervention as part of a broader effort to prevent illicit funds from entering the financial system.
Although Tether reported freezing more than $1.5 billion in USDT, blockchain intelligence data suggests that the intervention did not prevent all the stolen stablecoins from leaving the attackers’ initial wallets.
An investigation published by blockchain analytics company Bitquery on November 2 provided additional insight into how the stolen assets moved across different networks.
According to its findings, approximately $6.3 billion in digital assets left 17 Binance hot wallets across nine blockchain networks between October 29 and October 30.
The investigation found that approximately $2.7 billion in assets had been restricted through interventions involving Tether, Circle, Arbitrum’s Security Council and several smaller token issuers.
However, around $729 million in stolen USDT reportedly moved beyond the reach of Tether’s freezes. Much of the amount was converted into Ethereum and TRON-based assets, while some funds were transferred into decentralized finance lending protocols.
Bitquery also reported that Tether’s first major Ethereum freeze occurred 37 minutes after the main Ethereum drain. By that point, approximately $700 million in USDT had already moved from the initial receiving wallet into other addresses.
These findings offer a more detailed picture of the challenges facing stablecoin issuers when attempting to restrict stolen assets. Even when an issuer has the technical ability to blacklist a wallet, attackers can move funds through several addresses before restrictions take effect.
The findings also provide important context for investors assessing claims surrounding the Binance hack. Tether’s reported $1.5 billion intervention represents a substantial amount, but it should not be interpreted as a complete recovery of the stolen funds.
Beyond the efforts to freeze stolen cryptocurrency, Binance has announced measures aimed at protecting customers from the financial consequences of the incident.
In its October 30 security update, the exchange estimated the total impact of the attack at approximately $6.3 billion. It also confirmed that it had allocated more than $6.34 billion in company resources to cover the affected assets through its Secure Asset Fund for Users (SAFU) and corporate treasury.
Binance stated that approximately $3 billion in affected assets had already been frozen through cooperation with blockchain intelligence companies, law enforcement agencies and cryptocurrency issuers.
The exchange also disclosed that its initial investigation pointed to a potentially compromised DevOps engineer’s laptop, which may have allowed the attacker to access an internal service container and initiate unauthorized withdrawal transactions.
As part of its immediate response, the exchange temporarily suspended withdrawals while conducting additional security checks. Deposits and other unaffected services continued operating.
Binance also promised to publish an updated Proof of Reserves report after completing its security remediation process.
These measures are particularly important for investors because the Binance hack has raised questions about the security of centralized exchanges, even when customer balances are supported by substantial corporate reserves.
The company’s decision to absorb the financial impact is intended to reassure customers that the incident will not translate into direct losses for their account balances.
The latest developments shows two important aspects of the cryptocurrency industry: the importance of blockchain transparency and the influence centralized stablecoin issuers can exercise over digital assets.
However, the incident also shows that freezing assets is not always immediate enough to prevent attackers from transferring portions of their holdings.
The fact that hundreds of millions of dollars in USDT reportedly moved before restrictions took effect illustrates how quickly attackers can exploit the time between a breach and an intervention.
Tether’s reported freeze is a major development, but it does not conclude the recovery process. Investors will be watching for further updates from Binance, Tether and law enforcement authorities as investigators work to trace the remaining assets.
Copyright © 2025 - The Bit Gazette.
