The Binance hack: what happened, what was frozen, and what it teaches

The attack was prepared for at least 36 hours and executed chain by chain in under four. The cited analyses place the first issuer freezes within an hour of the first drains, but response times varied by chain, asset and address. The frozen total alone does not show what had already moved or been converted before a restriction took effect. All times UTC.

Elliptic’s 30 October update reports USD 6.43 billion stolen and USD 2.84 billion frozen. On that basis, USD 3.59 billion was not reported frozen. This is a snapshot of the reported freeze status, not a live inventory of attacker holdings.

What could happen to the remainder?

In comparable thefts, funds are split or consolidated, swapped into other assets, moved across bridges, and routed through mixing or cash-out services. Similar routes could be used here as the investigation continues. These are possible next steps, not a claim that every route has already been used in this case.

Chainalysis reports that part of the stolen stablecoins was rapidly swapped into ETH before freezes took effect. That illustrates the pressure on responders: tracing can continue after a swap, but the available ways to stop the funds can change.

Tracing is a starting point. Action depends on time and coordination. An investigation needs to reach the exchange, issuer or law-enforcement team able to act while funds remain within reach. The reported freezes show what cooperation can achieve; the funds that moved first show why the response must also be assessed by what escaped intervention.

Preparedness means having clear escalation routes, usable evidence and relationships across jurisdictions before an incident. The same access should be available to smaller organisations and individual victims. Faster reporting and cross-border procedures should not depend on privileged access to industry contacts.

Europe needs working relationships beyond Europe. As we described in our October newsletter, Roman Bieda spent four days at an INTERPOL cybercrime event in Asia, where Tether was also represented. Such discussions help connect Recoveris’s European base with investigators, law enforcement and industry counterparts where stolen assets may move. This is the practical value of public-private cooperation: getting evidence to people who can assess it and act.

Recoveris supports that work through investigation, evidence preparation and coordination alongside institutions and their legal teams. A freeze preserves an opportunity; returning assets still requires the appropriate legal and operational steps.

Recoveris helps exchanges, banks and VASPs trace stolen assets, prepare evidence and coordinate freeze requests with relevant platforms and law enforcement. The available steps depend on the assets, where they move and which organisations can act.