Tether says it blocked more than $1.5 billion in stolen USDT within 30 minutes of the Oct. 29 Binance hack, in an intervention the stablecoin issuer says prevented funds linked to North Korean hackers from being moved or laundered.
According to CryptoSlate, the freeze has become a case study in both the enforcement power and the limitations of issuer-controlled stablecoins. Tether can restrict USDT held in wallets it identifies as connected to suspicious activity, but it cannot directly reverse assets that attackers have already exchanged for other cryptocurrencies or placed into third-party protocols.
The incident followed an Oct. 31 alert from the FBI, which attributed more than $6 billion in stolen cryptocurrency from Binance to TraderTraitor, a hacking operation linked by US authorities to North Korea. The FBI has associated the operation with efforts to finance the country’s weapons programs.
Tether said its initial response came within half an hour of the attack. The company’s chief executive, Paolo Ardoino, argued that the ability to block suspicious addresses quickly makes USDT a difficult asset for criminals to retain and use. The company’s position is that transactions recorded on a public blockchain can be traced and restricted more directly than funds moving through less transparent channels.
What Tether froze
Tether’s disclosure said more than $1.5 billion in stolen USDT was frozen shortly after the Binance incident. A separate investigation by blockchain analytics firm Bitquery put the eventual amount of stolen USDT frozen at approximately $1.76 billion, or about 71% of the amount taken.
Bitquery identified 11 wallets controlled by the attackers that Tether froze across the Ethereum and TRON networks. Six of those wallets had already been emptied by the time the restrictions took effect, illustrating how quickly stolen digital assets can be moved between addresses and trading venues.
The investigation also found that approximately $729 million in stolen USDT escaped Tether’s freezes. Much of that amount was exchanged for Ethereum and TRON tokens through decentralized trading platforms. Once USDT is swapped for another token, Tether’s direct ability to restrict the funds is reduced because the assets are no longer represented by its own token.
In another example, an attacker-controlled wallet deposited $60 million in USDT into the Aave decentralized lending protocol shortly before the wallet was frozen. The attackers then borrowed approximately $45 million in ETH against the deposit. Because the USDT had entered Aave’s lending pool, freezing the original wallet did not immobilize the collateral.
Across stablecoin issuers and other emergency interventions, Bitquery estimated that around $2.7 billion of the stolen assets was immobilized or otherwise secured.
Broader debate over stablecoin enforcement
Tether presented the Binance response as part of a wider enforcement record. The company said it has frozen more than $7 billion in USDT held at secondary-market addresses and helped return approximately $1.2 billion to rightful owners and law-enforcement agencies through token reissuance.
Tether also said it has worked with more than 360 law-enforcement agencies in 73 countries to investigate financial crime and restrict suspicious transactions.
The figures have added fuel to an ongoing debate over whether stablecoins are primarily a risk for illicit finance or can also provide effective tools for identifying and disrupting it. Rayne Steinberg, co-founder of digital-asset investment firm Arca, contrasted Tether’s response with cases in traditional banking where illicit transactions were identified only after money had passed through financial institutions.
The immediate intervention does not mean the stolen funds have been recovered. Tether did not disclose who would receive the immobilized assets, whether legal authorization had been secured, or when any recovery or transfer would occur. The company has previously said it helped return frozen funds through reissuance, but no such timeline was provided for the Binance-linked USDT in this disclosure.
Bitquery estimated that the attackers still controlled approximately $3 billion in cryptocurrency as of Nov. 2, mainly in Bitcoin and Ethereum. US authorities have urged exchanges, blockchain operators and other service providers to block transactions associated with identified North Korean wallets.
Current market picture
Moneyiar market data recorded at 13:39 on Nov. 3, 2026, showed Ethereum at $2,292.3644215701, down 0.06% over 24 hours and 1.61% over seven days. Tether USDt was priced at $0.998281982, down 0.01% over both periods.
BNB stood at $699.1874916976, with a 24-hour decline of 0.63% and a seven-day decline of 5.68%. ApeCoin was at $0.1116922283, up 1.37% over 24 hours but down 7.34% over seven days.
The Binance-linked episode therefore highlights a central feature of blockchain-based finance: transactions can remain visible and traceable, while the speed and programmability of decentralized markets can allow stolen assets to move beyond an issuer’s control before restrictions are applied.
