--- title: "Tether, Circle, and Arbitrum Council Freeze 44% of $6.43B Stolen from Binance" description: "Stablecoin issuers blacklisted balances within an hour, while Arbitrum's Security Council forcibly moved assets without the attackers' private key." url: https://basisdesk.news/news/tether-circle-arbitrum-freeze-binance-hack-funds published: 2026-11-05T16:11:27.011Z modified: 2026-11-05T16:11:27.011Z section: Security & Hacks author: Basis Desk Newsroom (AI-generated, source-verified) sentiment: neutral tickers: [BTC, ETH, ARB, USDT, USDC] tags: [binance, arbitrum, tether, circle, elliptic, stablecoins, layer-2] license: Quote with attribution to Basis Desk (basisdesk.news). Not financial advice. --- # Tether, Circle, and Arbitrum Council Freeze 44% of $6.43B Stolen from Binance Stablecoin issuers blacklisted balances within an hour, while Arbitrum's Security Council forcibly moved assets without the attackers' private key. ## At a glance - **What happened:** Tether, Circle, and Arbitrum's Security Council intervened to freeze or seize roughly 44% of the $6.43 billion stolen from Binance [1]. - **Why it matters:** The swift actions immobilized billions in illicit funds, but demonstrated how issuer backdoors and layer-2 administrative councils can bypass private keys [1]. - **Who is affected:** Binance, Arbitrum token holders, stablecoin issuers, and protocol security architects [1]. - **What's next:** Legal and community determinations on releasing or reissuing the seized assets stored in holding wallets [1]. - **Primary source:** [If Crypto Can Be Frozen, Is It Yours?](https://unchainedcrypto.com/if-crypto-can-be-frozen-is-it-yours/) — unchainedcrypto.com ## Key points - Elliptic reports roughly 44% of the $6.43 billion stolen from Binance on Oct. 29 has been frozen or seized by stablecoin issuers and Arbitrum [1]. - Tether and Circle froze stablecoin balances within an hour, though neither issuer can touch native assets like the 18,270 stolen bitcoin [1]. - Arbitrum's 12-member Security Council used a 9-signature emergency threshold to move 8,425 ETH and 74.6 million ARB without the attacker's key [1]. ## Editorial remark - **Context:** The Binance hack saw attackers take $6.43 billion on Oct. 29, triggering immediate containment measures from centralized asset issuers and layer-2 emergency multisigs [1]. - **Impact:** Nearly half of the stolen funds are immobilized, reducing immediate liquidation risks, while reigniting fundamental debates over decentralization and administrative key override powers across layer-2 protocols [1]. - **Watch:** Decisions by token holders and legal authorities regarding the final disposition of seized ARB and ETH sitting in holding addresses [1]. Roughly 44% of the $6.43 billion stolen from crypto exchange Binance on Oct. 29 has been frozen or seized, according to blockchain analytics firm Elliptic [1]. The rapid asset containment, which included interventions from stablecoin issuers Tether and Circle alongside the Arbitrum network's governance body, contrasts sharply with the approximately 3% recovery rate seen after the Bybit breach in 2025 [1]. Minutes after the funds reached the attackers' primary wallet, Tether blacklisted the stolen $USDT within 37 minutes, while Circle froze $823 million in $USDC shortly thereafter [1]. Both issuers operate token smart contracts that contain administrative blacklists capable of preventing targeted addresses from transferring balances [1]. While Tether retains the programmatic ability to destroy and reissue blacklisted tokens—having previously returned around $1.2 billion across past incidents—Circle's contract lacks an automatic reissuance function [1]. Despite the prompt freezes, none of the 18,270 stolen $BTC or the ether held natively on the Ethereum mainnet have been frozen [1]. At the time of writing, $BTC was trading at $75,579, down 6.2% over 24 hours. ## Governance Override on Arbitrum Beyond centralized stablecoin interventions, the layer-2 network Arbitrum executed an administrative transfer of the hackers' funds [1]. While Arbitrum does not possess an explicit token-level freeze mechanism, its 12-member Security Council utilized emergency powers outlined in the network's constitution [1]. Requiring nine signatures, the council temporarily swapped the software layer that relays transactions into Arbitrum, executing two transactions on behalf of the hackers' address without their cryptographic keys [1]. This administrative intervention moved 8,425 $ETH and 74.6 million $ARB to a designated holding address [1]. The council had previously exercised this emergency authority in April against an exploiter of KelpDAO [1]. The incident renews ongoing scrutiny regarding protocol centralized control, as tracking site L2BEAT notes that 79 out of 83 layer-2 networks offer users no delay or withdrawal window prior to network upgrades taking immediate effect [1]. The unprecedented scale of the heist continues to prompt industry reflection on counterparty protections, as seen in [Coinbase Reassures Users on Cold Storage Architecture Following $6.4B Binance Hack](https://basisdesk.news/news/coinbase-cold-storage-security-controls-binance-hack) [1]. ## FAQ **Can Bitcoin or native Ethereum be frozen similarly?** No. Neither Bitcoin nor native layer-1 Ethereum contracts possess built-in blacklist switches or central emergency councils, meaning private keys remain the sole method for moving these assets [1]. **How did the Arbitrum Security Council move the hacker's assets?** With nine out of 12 signatures, the council temporarily altered the software that relays transactions to Arbitrum, executing transfers directly from the hacker's address under emergency constitutional powers [1]. ## Sources 1. [If Crypto Can Be Frozen, Is It Yours?](https://unchainedcrypto.com/if-crypto-can-be-frozen-is-it-yours/) — unchainedcrypto.com, 2026-11-05 --- Basis Desk Newsroom · AI-generated, source-verified · https://basisdesk.news/about/how-we-use-ai