Key Takeaways
- The FBI attributed the theft of more than $6 billion to North Korea.
- Approximately $729 million in stolen USDT moved before freezes took effect.
- Tether reported more than $7 billion frozen across secondary market addresses.
Tether Describes $1.5 Billion Binance Hack Freeze
Tether said on Nov. 2 that it had frozen more than $1.5 billion in USDT within 30 minutes of the Oct. 29 Binance attack. The company stated that its intervention prevented those assets from being transferred, swapped, or laundered, keeping them beyond the attackers’ reach.
Paolo Ardoino, Tether’s CEO, affirmed:
“Within minutes of the hack, our team had frozen more than $1.5 billion.”
Bo Hines, CEO of Tether’s U.S. stablecoin business, commented: “We moved immediately and stopped more than $1.5 billion from reaching the people behind this attack.”
The Federal Bureau of Investigation (FBI) attributed the Binance theft to North Korea on Oct. 31, identifying the malicious cyber activity as Tradertraitor, the bureau’s designation for the North Korean cyber activity. Investigators observed stolen assets being converted primarily into ether and anticipated further laundering through decentralized finance platforms and instant swap services, which exchange one cryptocurrency for another. The bureau urged cryptocurrency businesses and infrastructure operators to block transactions involving associated addresses.
Onchain Findings Show Funds Moved Before Freezes
Bitquery’s onchain analysis of the Binance attack placed Tether’s first freeze 37 minutes after the main Ethereum drain and 57 minutes after the first attack transfer. The investigation also traced approximately $729 million in stolen USDT that moved before Tether’s freezes took effect. Most of that amount was swapped into ether and TRX, the cryptocurrency used on the Tron network.
Issuers of stablecoins such as USDT and USDC can restrict transfers involving specified addresses. Tether can block USDT transfers involving those addresses, restricting access to the tokens held there. Returning the assets to victims requires further recovery steps.
Binance separately reserved more than $6.34 billion in company funds to replace affected assets, excluding approximately $3 billion frozen during the response. Its replacement purchases addressed the exchange’s obligations to users independently of efforts to recover the stolen cryptocurrencies.
Enforcement Actions Extend Beyond Binance
Tether’s April intervention involved a $344 million USDT freeze coordinated with U.S. authorities. The company said its wallet-freezing policy aligns with the Treasury Department’s Office of Foreign Assets Control (OFAC) sanctions list. Its latest announcement put its law enforcement relationships at more than 360 agencies across 73 countries.
Following an approximately $285 million April exploit at Drift, a Solana-based cryptocurrency trading platform, Tether committed up to $127.5 million toward its recovery. That commitment formed part of a broader support plan tied to the platform’s recovery and future trading revenue.
Including the Binance intervention, Tether reported more than $7 billion in USDT frozen in secondary market addresses, mostly connected to fraud and theft. Separately, as of Oct. 31, it had helped freeze more than 3,590 wallets holding approximately $1.6 billion for the U.S. Department of Justice, Secret Service, and FBI. It also said approximately $1.2 billion obtained through fraud and theft had been returned to rightful owners and law enforcement through reissuance.
