Tether and Circle freeze $823 million in stolen funds after $6.43 billion Binance hack

Hackers stole $6.43 billion from Binance on October 29, blockchain analytics company Elliptic reported. Within an hour, stablecoin issuers Tether and Circle responded by freezing most of the stolen assets held in USDT and USDC.

Rapid response from stablecoin issuers

Tether and Circle, the companies behind the two largest USD-pegged stablecoins, acted quickly in the aftermath of the Binance hack. Both companies exercised control over their respective token contracts to restrict access to stolen funds. According to Elliptic, Tether froze the compromised USDT just 37 minutes after the hackers moved it to their main wallet, while Circle locked $823 million in USDC only minutes later. Both blocked balances remain in the hackers’ wallet.

Tether can blacklist any address holding its tokens, preventing those addresses from conducting transfers. The company also has authority to destroy blacklisted balances and reissue the tokens, a feature that Tether says enabled the recovery of approximately $1.2 billion from previous thefts. In contrast, Circle’s USDC contract contains an embedded blacklist but does not allow the destruction and reissuance of tokens.

Tether froze the Binance hackers’ USDT less than 40 minutes after its arrival in the wallet, and Circle acted just minutes later to freeze nearly $823 million in USDC, according to Elliptic’s analysis.

Circle, which manages USDC, maintains that it freezes funds only when legally required by an appropriate authority. However, American Banker reported that in May Circle updated its policy to include exceptions for urgent law enforcement requests, even prior to receiving a court order.

Oversight mechanisms on Arbitrum network

Unlike Tether and Circle, the Arbitrum blockchain network employs a governance model centered on a Security Council. While there is no direct “freeze” function, a 12-member council, elected by token holders, can intervene in emergencies. Nine members’ signatures are needed to take quick action. In this incident, the council temporarily replaced the software component handling Arbitrum transactions and used this power to move assets: 8,425 ETH and 74.6 million ARB, Arbitrum’s native token, were transferred out of the hackers’ wallets and placed into a secure holding address.

Arbitrum’s constitution allows the council to make immediate software upgrades when required for network security. In a previous case in April, the council intervened to freeze assets stolen from KelpDAO. The process to release those funds took until June 15, delayed by legal proceedings, including a restraining notice connected to North Korea-related court judgments and a subsequent federal court order.

Mini dictionary: Arbitrum Security Council – A 12-person group elected by token holders on the Arbitrum blockchain. The council holds emergency powers to approve changes to the network’s code, particularly to address critical vulnerabilities or respond to security incidents.

Other networks and the trend toward freeze powers

The trend for rapid freeze authority is spreading to newer networks. Robinhood Chain, which launched in July using Arbitrum’s technology, has given similar emergency powers to its own wallet system. With seven out of eight required signatures, Robinhood wallets can freeze assets with no waiting period. According to L2BEAT, a risk assessment platform for blockchain networks, 79 of 83 tracked layer-2 networks allow no window for withdrawals once an upgrade is initiated, reinforcing centralized emergency control in a decentralized landscape.

This approach highlights the balance between security and decentralization for networks managing significant funds. For users, the ability of centralized actors or councils to intervene raises ongoing debates about trust, the original promise of crypto, and the right conditions for freezing digital assets.

Technical and regulatory context

Unlike with stablecoins or tokens operated by organizations, neither exchanges nor outside parties could freeze the Bitcoin stolen in the Binance attack. Bitcoin’s protocol structure is designed intentionally so that only individuals holding the private key can move coins, with no central authority empowered to reverse or restrict transactions. In rare cases, blockchain communities have coordinated large-scale reversals, but these have typically required broad consensus and exceptional circumstances.

Debate continues regarding the proper circumstances for freezing digital assets, who should hold that power, and how regulatory trends in the United States are shaping stablecoin contracts to include expanded freeze mechanisms. The increasing reliance on swift freezing capabilities reflects both regulatory pressure and the ongoing evolution of digital asset management.

Price movements or market impacts for the affected tokens, including ARB and RUNE, have not been detailed in relation to these specific freezes at this time.