On October 29, 2026, an attacker stole billions of dollars in cryptocurrency from Binance. The money moved across multiple blockchains, leaving investigators with an enormous task: finding the stolen assets before they disappeared into the wider crypto market.
Then something unusual happened.
Some of the stolen tokens became impossible to move. Others remained beyond the reach of the companies trying to stop the theft. And on Arbitrum, a group of network security representatives took additional action, moving assets out of an attacker-controlled address without the attacker’s permission.
All of this happened on blockchains that are supposed to operate without traditional financial intermediaries.
By October 30, Binance reported that it had frozen roughly $3 billion of the estimated $6.3 billion stolen, according to its official security incident update.
That sounds like a remarkable recovery.
Except there’s a catch. Freezing cryptocurrency isn’t the same as getting it back.
The distinction reveals something important about how crypto actually works. A Bitcoin transaction, a USDC transfer, and an ETH balance held on a Layer 2 network may all appear in familiar-looking wallets, but they don’t necessarily follow the same rules when someone wants to stop the money from moving.
The Binance attack offers a particularly revealing example of where those rules collide.
How Much of the Stolen Crypto Was Actually Stopped?
The number that attracted immediate attention was $3 billion.
It represented a substantial amount of cryptocurrency that Binance and its partners said they had prevented from moving further.
But how much of the theft did that actually cover?
Using Binance’s reported figures, Ravel calculates that the frozen assets represented 47.6% of the estimated $6.3 billion loss.
That leaves $3.3 billion, or 52.4%, not reported as frozen at the same reporting point.
There’s another way to examine the response.
Blockchain intelligence firm TRM Labs published an investigation of the stolen funds, estimating losses of $6.36 billion across ten blockchains.
Its earlier on-chain snapshot, covering activity through October 30 at 00:30 UTC, identified about $2.7 billion in frozen assets.
That amounts to 42.5% of TRM’s estimated losses.
The two percentages aren’t contradictory. They come from different reporting times, with different estimates and verification methods. The underlying figures are rounded, and additional freezing actions can change the totals.
What’s more interesting is what those percentages don’t tell us.
They measure assets reported as immobilized, not money returned to Binance.
A frozen stablecoin balance can remain recorded at the attacker’s address. The tokens still exist, the blockchain still recognizes the balance, and the attacker may still possess the private key.
What changes is whether the relevant system will allow those assets to move.
That’s a very different outcome from transferring the money back to its rightful owner.
Nor should the remaining 52.4% automatically be treated as permanently lost. Some assets can still be traced, some might eventually reach exchanges that cooperate with investigators, and other recovery methods may become available.
The initial freeze is only one stage of a much longer process.
Why Some Stolen Tokens Could Be Frozen While Bitcoin Couldn’t
The most revealing part of the Binance incident is that different groups stopped different assets using entirely different mechanisms.
Consider the stablecoins first.
USDC is issued by Circle, which retains administrative authority over certain functions in its token smart contract.
Under Circle’s official blocklisting policy, an address can be prevented from sending or receiving USDC in specified circumstances.
The process doesn’t require Circle to obtain the wallet’s private key.
Instead, an authorized operation changes the rules governing transfers involving that address.
This is possible because USDC is an issuer-controlled token operating on a blockchain, not the blockchain’s native currency.
Tether has similar freezing capabilities for USDT. Its published Ethereum smart contract also contains a separate destroyBlackFunds function, which can destroy the balance of a blacklisted address when called with the required authority.
That doesn’t mean frozen USDT is automatically destroyed or returned. It demonstrates that restriction and destruction are separate operations.
But the Binance case exposed a third mechanism, and this one is considerably more surprising.
On October 30, Arbitrum’s Security Council intervened to secure 8,425 ETH and more than 74.5 million ARB associated with the exploit.
Unlike Circle or Tether, the council wasn’t simply changing the blacklist status of an issuer-controlled stablecoin.
According to the official Arbitrum governance announcement, the council temporarily upgraded the network’s Inbox contract, used a special function to impersonate the attacker-associated address, and executed transactions moving the funds into a designated holding address.
The Inbox contract was subsequently returned to its original implementation.
Those assets are now held at 0x0000000000000000000000000000000000000DA0, with their future movement subject to ArbitrumDAO governance.
That’s quite a different kind of intervention.
An attacker didn’t voluntarily authorize the transfer. The network’s emergency governance machinery enabled it.
Importantly, this was an action on Arbitrum One, not a demonstration that someone can remotely confiscate ordinary ETH balances on Ethereum mainnet.
It nevertheless illustrates how a Layer 2’s administrative and upgrade powers can create possibilities that don’t exist in the same form on its underlying network.
Now compare that with Bitcoin.
Investigators traced 18,270 BTC, valued by TRM at around $1.47 billion when stolen.
That’s 23.1% of TRM’s estimated $6.36 billion loss, based on Ravel’s calculation.
Bitcoin does not have a central issuer or an administrator who can blacklist an ordinary Bitcoin address and disable its coins.
As the Bitcoin developer documentation explains, Bitcoin transactions spend unspent transaction outputs by satisfying their associated script conditions.
There is no equivalent of Circle’s issuer-controlled USDC blacklist that can simply be activated against a particular Bitcoin address.
That doesn’t make stolen Bitcoin invisible or guarantee a thief can convert it into cash.
Investigators can monitor transactions, and exchanges can reject deposits associated with identified stolen funds. Law enforcement may also recover Bitcoin through seizures, cooperation, or access to the relevant keys.
But those are interventions around the Bitcoin network, rather than an administrative command that freezes the coins within Bitcoin’s normal consensus rules.
The same theft therefore encountered three different systems of control.
Stablecoin issuers could restrict their tokens. Arbitrum’s Security Council could exercise emergency network authority. Bitcoin had no comparable issuer or administrator capable of freezing its native asset.
Calling all three simply crypto obscures some fairly important differences.
If the Money Is Frozen, Who Gets It Back?
Suppose investigators identify a wallet holding $10 million in stolen USDC.
Circle freezes the address. The funds can no longer move through normal USDC transfers.
Has the victim recovered $10 million?
No.
The tokens remain inaccessible, and the next step involves establishing who is legally entitled to the value and which procedures can lawfully make it available.
Depending on the asset and the circumstances, the process may involve court orders, law enforcement coordination, issuer action, governance decisions, or the seizure of other assets.
Even when the correct recipient is known, the technical mechanism used to immobilize the funds might not provide a simple way to transfer them back.
Circle, for example, distinguishes blocklisting from reversing completed transactions. Freezing an address doesn’t undo the original theft.
The Arbitrum case presents a different situation. The targeted assets were transferred into a designated holding address through the emergency action. But a future transfer out of that address requires governance authorization.
In neither case should the initial intervention automatically be counted as money already returned to Binance.
There’s a further complication.
Imagine a thief receives $100 million in USDT and immediately exchanges $60 million for ETH before Tether freezes the destination address.
The issuer might successfully block the remaining $40 million.
But the $60 million already converted into ETH is no longer governed by the same USDT blacklist mechanism.
This is an illustrative example, not a reconstruction of a particular Binance transaction. It explains why the timing of a freeze can be as important as the issuer’s authority to execute it.
The Binance attacker did convert some stolen stablecoins into other assets before freezing actions could stop them, according to TRM’s investigation.
That helps explain why billions could be immobilized while other assets remained outside the reach of issuer-controlled restrictions.
Binance has also taken a separate approach to protecting its customers.
In its October 30 update, the exchange said it had set aside more than $6.34 billion in company funds, including over $5 billion held in the types of assets affected by the theft. It pledged to absorb the financial losses through its corporate resources and SAFU fund.
This is an important distinction.
Replacing customer assets with company resources is not the same as recovering stolen cryptocurrency from the attacker.
The two processes can happen independently.
Even if the stolen funds remain frozen for an extended period, an exchange might replenish customer balances from other resources. Conversely, a successful recovery could eventually return assets to the exchange without changing what happened during the original hack.
For users, there is also a less comfortable implication.
The same powers that help stop a thief may create dependencies on administrators, security councils, and legal institutions.
Those powers can be valuable during an emergency. They can also raise difficult questions about governance, accountability, and the circumstances under which someone else’s assets might be restricted.
Decentralization is not a single feature shared equally by every cryptocurrency.
It depends on which asset is being transferred, which network processes the transaction, and who can change the rules governing that transfer.
The Binance incident didn’t suddenly make crypto centralized. It exposed the different control arrangements that were already there.
And it showed why three words that frequently appear together in crypto theft headlines should never be treated as interchangeable.
Traced means the money has been located. ‘Frozen’ means its movement has been restricted. ‘Recovered’ means control or value has actually been returned through an authorized process.
A blockchain can reveal where stolen money went. Some systems can even stop it from moving.
Neither guarantees that the rightful owner will get it back.
