Tether freezes $1.5 billion in 30 minutes after Binance hack, but $729 million escapes

In a Nov. 2 statement, the world's largest stablecoin issuer said its intervention prevented the immobilized funds from being transferred or laundered by attackers linked to North Korea. The announcement followed an Oct. 31 FBI alert attributing the theft of more than $6 billion from Binance to North Korea's TraderTraitor hacking operation, which US authorities have linked to efforts to finance the country's weapons programs.

Stablecoin effectiveness debated

Tether CEO Paolo Ardoino said the incident demonstrated why USDT was an unattractive vehicle for criminals, arguing that the company's ability to rapidly block suspicious addresses made it difficult for attackers to retain access to stolen assets.

The intervention prompted a broader debate about stablecoins' effectiveness in combating financial crime. Steinberg contrasted Tether's response with traditional banks' histories of processing illicit transactions, arguing that financial institutions have often identified money laundering only after funds had already moved through their systems.

Hundreds of millions escaped freeze

Despite the rapid intervention, blockchain investigators found that attackers managed to move substantial amounts of stolen USDT before Tether could restrict their wallets. According to Bitquery's investigation, approximately $729 million in stolen USDT escaped the freezes, with much of the money converted into Ethereum and TRON tokens through decentralized trading platforms.

The firm identified 11 attacker-controlled wallets frozen by Tether across Ethereum and TRON, six of which had already been emptied when restrictions took effect. One attacker-controlled wallet also deposited $60 million in USDT into decentralized lending protocol Aave shortly before being frozen, allowing the hackers to borrow approximately $45 million in ETH against those assets.

Bitquery estimated that approximately $1.76 billion in stolen USDT was ultimately frozen, representing about 71% of the amount taken. Across stablecoin issuers and other emergency interventions, roughly $2.7 billion of the stolen assets was immobilized or secured.

Recovery remains uncertain

The findings illustrate both the effectiveness and limitations of issuer-controlled freezes. Tether can restrict transfers from identified wallets, but assets already exchanged into cryptocurrencies such as ETH remain outside its direct control.

The fate of the immobilized funds remains unresolved. Although Tether has previously helped transfer frozen assets to law enforcement or rightful owners through reissuance, its latest disclosure did not identify a receiving party, legal authorization, or recovery timeline for the Binance-linked USDT.

Bitquery estimated that the attackers still controlled approximately $3 billion in cryptocurrency as of Nov. 2, predominantly Bitcoin and Ethereum, with US authorities urging exchanges, blockchain operators and other service providers to block transactions associated with identified North Korean wallets.