# Issuers freeze about $3 billion of Binance loot as the attackers switch to automated laundering that Chainalysis says it has not seen before

The attackers swapped $325 million of stablecoins for $285 million of ether. They gave up about $40 million to move into an asset no issuer can block.

- Published: 2026-10-31T05:43:59.168Z
- Canonical: https://polylog.news/crypto/2026-10-31/issuers-freeze-about-3-billion-of-binance-loot-as-the-attack
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [CoinDesk](https://www.coindesk.com/business/2026/10/30/experts-divided-over-binance-hack-asset-freezes-warn-recovery-is-another-matter), [CryptoSlate](https://cryptoslate.com/binance-hackers-deploy-never-seen-before-laundering-tactics-to-conceal-6-3-billion-theft/), [Polylog editors](https://polylog.news), [Chainalysis](https://www.chainalysis.com/blog/binance-exploit-latest-findings-and-response/), [DailyCoin](https://dailycoin.com/binance-hack-unusual-money-laundering-patterns-chainalysis)

Tether, Circle and other firms [moved within hours](https://www.coindesk.com/business/2026/10/30/experts-divided-over-binance-hack-asset-freezes-warn-recovery-is-another-matter) to block billions of dollars of stolen tokens. Chainalysis counts [$2.8 billion frozen so far](https://dailycoin.com/binance-hack-unusual-money-laundering-patterns-chainalysis), and Binance's partners put the figure near $3 billion. The freezes worked because a large share of the loot was in stablecoins, whose issuers can blacklist addresses. Freezing is not recovery. Legal experts quoted by CoinDesk said returning frozen tokens to Binance requires a separate legal process. They also questioned whether smaller victims would get the same fast action from issuers.

The attackers' response shows they expected freezes. Chainalysis found [thousands of transactions in a short window](https://cryptoslate.com/binance-hackers-deploy-never-seen-before-laundering-tactics-to-conceal-6-3-billion-theft/) and called the pattern "never-seen-before." According to the [firm's findings](https://www.chainalysis.com/blog/binance-exploit-latest-findings-and-response/), funds cycled among addresses and returned to wallets used earlier in the chain. Many addresses first received exactly 1 unit of TRX, Tron's native token, before they took larger sums. Chainalysis said this repeated sequence points to a programmed process. The attackers mixed Binance proceeds with funds from the September theft at Bitget, another exchange. They also exchanged $325 million of stablecoins for $285 million of ether.

The episode also produced an unusual side event. An address using the name "vtalik.eth", made to resemble Ethereum co-founder Vitalik Buterin's handle, [sent an on-chain message to the attackers](https://t.me/GokuCryptoNews/21146), according to the French-language channel Goku Crypto News. The channel says the message advised them on how to keep the stolen funds. Nothing ties the message to Buterin.

## What this means

The mechanism is control at the issuer. Tether and Circle can blacklist addresses, so the stolen stablecoins became frozen claims, while the bitcoin and ether did not. The attackers paid roughly a 12% discount to leave freezable assets, which puts a price on censorship resistance during a crisis. Holders of freezable assets carry a risk that bitcoin and ether holders do not. Governments gain an enforcement tool they can direct through two private issuers, Tether and Circle. The usual view treats freezes as proof that crypto can police itself. That view misses that Tether and Circle chose the timing and scope without a court order, so protection depends on their discretion. The Bybit precedent of 2025 suggests most of the unfrozen funds will be converted and leave tracing within weeks. The likelier course is that frozen balances remain locked for months while legal fights decide who owns them, and most of the remaining roughly $3 billion is laundered through ether and cross-chain routes. A large share of the unfrozen funds being stopped at exchanges or bridges would prove this read wrong.

## What to watch

- Whether Tether or Circle files or joins a court action to return frozen tokens to Binance. The legal path will set the precedent for every future freeze.
- How much of the converted ether moves through cross-chain bridges and over-the-counter brokers in Asia. Those exits are where previous North Korean thefts were cashed out.
- Whether the Treasury Department sanctions the laundering addresses or the services they use. Designations would widen the circle of firms that must refuse the funds.