By Tether says it froze more than $1.5 billion in USDT connected to the October 29 Binance hack, highlighting the role stablecoin issuers can play in restricting the movement of stolen cryptocurrency.
In a November 2 statement, the company said it immobilized the assets within 30 minutes of the attack, preventing the funds from being transferred, exchanged or laundered.
The intervention followed a security breach in which approximately $6.3 billion in cryptocurrency was stolen from Binance-controlled wallets across multiple blockchain networks. Tether CEO Paolo Ardoino said the response demonstrated the company’s ability to prevent criminals from using USDT to move illicit proceeds.
However, independent blockchain analysis has raised questions about the precise timing of the freezes and the amount of stolen cryptocurrency transferred before intervention. The distinction is important because freezing assets prevents further movement from designated addresses but cannot reverse transactions already completed.
Blockchain Data Challenges Tether’s 30-Minute Timeline
According to blockchain transaction records examined by TokenPost, a major transfer of approximately 1.615 billion USDT occurred on Ethereum at 20:24:23 UTC on October 29. The first substantial freeze at the receiving address occurred at 21:01:35 UTC, approximately 37 minutes later.
That transaction immobilized around 971.1 million USDT. Additional freezes continued until approximately 21:21 UTC, bringing the combined amount frozen across Ethereum and Tron to roughly $1.555 billion.
A separate $8.4 million freeze was recorded on Avalanche. Tether’s announcement did not specify which event marked the beginning of its stated 30-minute response period. The company therefore may have measured its response from a different point in the incident timeline.
Before the first major freeze, approximately $700 million had moved from the principal receiving address through two transactions. Blockchain analytics company Bitquery separately estimated that approximately $729 million in stolen USDT escaped the initial freezing efforts.
Some of those funds were subsequently converted into other cryptocurrencies, while additional amounts were frozen in downstream wallets. These findings do not dispute that Tether immobilized more than $1.5 billion. Instead, they indicate that the company’s description of the response time requires further clarification.
Tether Highlights $7 Billion in Historical Freezes
Tether said it has worked with more than 360 law enforcement agencies across 73 countries to investigate illicit cryptocurrency activity. As of October 31, the company reported assisting US authorities in freezing approximately 1.6 billion USDT across more than 3,590 wallets.
Those figures cover broader enforcement activity and should not be interpreted as additional funds recovered from the Binance incident. Tether also reported freezing more than $7 billion in USDT across secondary-market addresses over time, including assets connected to fraud, theft and exchange compromises.
Approximately $1.2 billion associated with illicit activity has been returned to victims or law enforcement through token reissuance, according to the company. The Binance investigation involves several stablecoin issuers and blockchain infrastructure providers.
Circle separately froze more than $800 million in assets connected to the breach, while Binance reported approximately $3 billion frozen on-chain by October 30. The FBI has attributed the attack to North Korean-linked hackers, although Pyongyang has denied involvement.
Binance has pledged to absorb customer losses using its corporate treasury and Secure Asset Fund for Users. The incident highlights both the advantages and limitations of centralized stablecoins during major cryptocurrency thefts. Issuers can prevent transfers from identified addresses, but assets moved into other cryptocurrencies or decentralized protocols may be harder to recover.
For investigators, the remaining challenge is tracing funds that escaped initial intervention. For Tether, the discrepancy between its reported response time and public blockchain timestamps underscores the importance of transparent, independently verifiable security reporting.