Tether and Circle Freeze 2.6 Billion USD in the Largest Stablecoin Blacklist Ever as the Suspected Binance Breach Nears 6 Billion USD

The largest coordinated freeze in stablecoin history is underway. Issuers including Tether, Circle, Ripple, Paxos, and World Liberty Financial have collectively frozen more than 2.6 billion USD in digital assets linked to the suspected Binance security breach, an incident that saw nearly 6 billion USD in assets leave exchange-linked wallets in a matter of minutes.

Tether leads the biggest blacklist operation ever seen

Tether moved first and moved big. CEO Paolo Ardoino announced on Oct. 29 that the company had frozen more than 1.567 billion USD in USDT connected to the suspected breach. “Protecting the industry and our partners is our main priority,” Ardoino wrote on X, framing the decision as a defensive measure for the entire ecosystem rather than a favor to any single exchange.

Circle followed with approximately 823 million USD in frozen USDC. CEO Jeremy Allaire confirmed the company was coordinating with law enforcement to restrict the movement of potentially compromised assets and to support the ongoing investigation. The speed of the response matters: every hour a hacker holds transferable stablecoins is an hour those tokens can be swapped, bridged, or dispersed beyond recovery.

The freeze did not stop with the two giants. Ripple reportedly froze roughly 200 million USD, while Donald Trump-linked World Liberty Financial restricted 27 million USD of its USD1 stablecoin. Paxos disclosed it had frozen 1,906.67 PAX Gold tokens worth more than 8 million USD. Add it all up and the total exceeds 2.6 billion USD — a substantial share of the roughly 6 billion USD reportedly transferred out of Binance-linked wallets.

How the suspected breach unfolded

According to crypto research firm Kairos Research, about 5.7 billion USD left Binance hot wallets in the incident. The suspicious activity began at 4:20 p.m. ET, when an external address used Ethereum’s EIP-7702 account-delegation mechanism to attach executable code to a Binance hot wallet — effectively turning the exchange’s own wallet infrastructure into a delivery system for the attacker’s instructions.

Three minutes later, a single transaction swept 63 different tokens out of the wallet, including 1.6 billion USDT and 167,000 ETH. Another Binance hot wallet transferred 28,000 ETH to the same destination, while 18,270 BTC and 613 million USDT on Tron moved to fresh addresses around the same time. The attacker kept moving assets even after the first freezes landed, including another 200 million USDT pushed through the compromised Ethereum wallet before it, too, was frozen.

Before Tether intervened, the suspected attacker also deposited 60 million USD in USDT into the lending protocol Aave and borrowed roughly 19,800 ETH, worth about 45 million USD at the time — a classic move to convert frozen-risk stablecoins into harder-to-freeze assets.

What this means for Bitcoin holders

Binance has confirmed its security teams are investigating the suspicious activity and has publicly assured customers that their assets are safe, promising further updates once the circumstances are verified. The exchange has not confirmed the total amount potentially compromised, which leaves the true scale of the breach unresolved.

For everyday Bitcoin investors, the episode is a live demonstration of how the industry’s immune system responds to a mega-breach. Stablecoin issuers can freeze their tokens at the smart-contract level, which is exactly what reclaimed 2.6 billion USD of the haul. But approximately 850 million USD in ETH kept moving between newly created wallets, and 17,270 BTC — worth well over a billion dollars — sat untouched, because nobody can freeze Bitcoin. That asymmetry is why hackers prize non-custodial assets and why the unfrozen portion of this incident remains the biggest open question.

It is also why Bitcoin dipped below 79,000 USD in the hours after the news before whipsawing back. Markets initially priced in worst-case contagion fears, then partially recovered as the freeze totals climbed and Aave moved to pause its Ethereum lending markets as a precaution. Aave stated that its contracts were unaffected and positions remained overcollateralized, freezing all DAO-operated markets across V3 and V4 while still allowing withdrawals and repayments.

The centralized backstop debate, resurfaced

The freeze operation will reignite the oldest argument in crypto. Critics of centralized stablecoins will point out that 2.6 billion USD in tokens was neutralized by a handful of executives making phone calls — proof, they will say, that these assets are not permissionless money. Defenders will counter that this is precisely the feature: the ability to claw back stolen funds from a hack of this magnitude is something no pure blockchain can offer, and it may be the only reason a 6 billion USD breach did not become a 6 billion USD loss for users.

Both readings contain truth, and Bitcoin sits in the middle of the tension. The largest cryptocurrency cannot be frozen by any issuer, which makes it the endgame asset for the attacker — and simultaneously the asset whose value proposition depends on that immutability. Every investor watching this incident unfold should understand the trade-off: the same centralization that recovered stolen stablecoins is the centralization Bitcoin was built to escape.

What to watch next

Three things will determine how this story ends. First, Binance’s formal confirmation of the compromised total — the gap between the reported 5.7 to 6 billion USD outflow and what the exchange acknowledges. Second, whether law enforcement, now formally in the loop with Circle’s coordination, can trace the roughly 850 million USD in still-moving ETH. Third, the fate of the 17,270 BTC sitting untouched — if those coins start moving through mixers, the industry will be watching every block.

For now, the freeze stands as the single largest use of stablecoin blacklist power in history. It protected exchange users, protected the issuers’ own balance sheets, and demonstrated that in a crisis, crypto’s decentralized ideals bend quickly toward centralized damage control. Whether that comforts or alarms you probably depends on which side of the trade-off your portfolio lives on.