# Binance Hack: How the Attacker Dodged the USDT Freeze

> Tether and Circle froze billions after the $6.3B Binance hack, but the attacker turned $60M of USDT into ETH on Aave first. What happened and what to learn.

Source: https://playciso.com/blog/binance-hack-aave-loan-usdt-freeze · Published: 2026-10-31 · Publisher: PlayCISO (https://playciso.com)

Primary source: https://www.theblock.co/news/business/2026-10-30-binance-hack-largest-crypto-hack-north-korea-432225

---

On 29 October 2026 attackers drained Binance's hot wallets in what Binance puts at about **$6.3 billion**, the largest crypto theft on record. Within hours **Tether** and **Circle** froze well over $2 billion of stolen stablecoins. But about 40 minutes before the first freeze, the attacker had already used **60 million USDT** as collateral on **Aave** to borrow **19,762 ether**, which nobody can freeze. Binance says it will cover all user losses. **Who this is for:** security leaders, finance and treasury teams, and anyone holding assets on an exchange. _Based on statements from Binance, Tether, Circle and LlamaRisk, and reporting by The Block, CoinDesk, CNBC, Cointelegraph, Decrypt and The Hacker News, as of 31 October 2026, including Binance's 31 October update to users. Figures were still changing. PlayCISO is not affiliated with any of these companies._ Confirmed vs not yet known **Confirmed by Binance:** about $6.3 billion in assets affected; all user losses to be covered from SAFU and company funds; withdrawals temporarily suspended; no evidence found of a wallet private key leak. **Confirmed by the issuers:** Tether froze more than $1.567 billion of USDT (CEO Paolo Ardoino); Circle froze more than $800 million of USDC (CEO Jeremy Allaire). **Reported by LlamaRisk and Elliptic:** 60 million USDT deposited on Aave and 19,762 WETH (about $44.6 million) borrowed. **Binance update, 31 October:** about 90% of affected assets replenished (up from about 80%); ten major tokens backed at 100%; a new Proof of Reserves snapshot taken at 00:00 UTC, with the zero-knowledge proof expected around 3 November; withdrawals on track to reopen on 1 November. **Not yet known:** how the attackers got in (Binance has promised a post-mortem), who they are, and how much will be recovered. ## What happened Binance says attackers moved funds out of its hot wallets, the online wallets an exchange uses to pay out withdrawals, on 29 October. Binance puts the affected assets at about $6.3 billion; Chainalysis estimated about $5.9 billion stolen, according to reporting at the time. Binance suspended withdrawals while it reworked its withdrawal security and said it found "no evidence of any wallet private key leak." ## Update, 31 October: 90% replenished, withdrawals due 1 November In an update emailed to users on 31 October, Binance said the share of affected assets it has replenished rose from about 80% to about 90%. It said BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are "fully backed at 100%", and that it will keep buying the rest through market and over-the-counter channels. The outstanding 10%, Binance said, is less liquid tokens outside the top ten. Binance named three sources for the money: a partial deployment of its Secure Asset Fund for Users (SAFU), which it expected to complete within 24 hours; part of its Futures Insurance Fund, which it said always keeps a remaining balance; and its own corporate treasury. It repeated that it "will cover all direct losses associated with the incident." Binance also said it took a new Proof of Reserves snapshot at 00:00 UTC on 31 October. The zero-knowledge proof takes 40 to 50 hours to generate, so holders of the ten tokens should be able to check that their balances are backed at least 1:1 from about Tuesday 3 November. Withdrawals, Binance said, remain on track to reopen on Sunday 1 November, with confirmed details to follow. These are Binance's own figures; we have not seen an independent check of them yet. The same email warned that anyone who contacts users claiming to be Binance and asks for a password, one-time code or seed phrase is a scammer. Expect a wave of fake "withdrawal reopening" and "compensation" messages around 1 November. ## The freezes, and the Aave loan that got around them Stablecoins like USDT and USDC are issued by companies, and their contracts let the issuer freeze tokens held by a particular address. Tether and Circle used that power within hours. If the stolen USDT had simply sat in the attacker's wallets, freezing it would have made it worthless to him. According to LlamaRisk, a risk provider to Aave, and Elliptic, the attacker moved first. Between 20:58 and 21:01 UTC on 29 October, about 40 minutes before the first freeze, he deposited 60 million USDT into Aave, a lending protocol, and borrowed 19,762 WETH (wrapped ether) against it, worth about $44.6 million at the time. - Why it worked: ether has no issuer and no freeze switch. Once the value was in ETH, the USDT freeze no longer reached it. - The price he paid: he gave up $60 million of USDT to walk away with about $44.6 million of ETH, roughly 74 cents on the dollar, and he is not expected to repay the loan. Freezable money he could not have used became unfreezable money he could. - Aave's position: LlamaRisk said Aave suppliers were not at risk because the loan was over-collateralised and remained subject to normal liquidation. Aave froze some markets after the hack; The Block later reported Aave said it had unfrozen its V3 and V4 markets and that its contracts were unaffected. The Aave loan was a small part of the total. Most of the stolen value was in assets that, like ETH, cannot be frozen by an issuer, which is why investigators describe the recovery as a "cat and mouse game" (CNBC). ## Timeline When (2026, UTC)WhatSource 29 OctSuspicious outflows from Binance hot wallets detected; Binance investigatesThe Block, CoinDesk 29 Oct, 20:58–21:01Attacker deposits 60M USDT on Aave and borrows 19,762 WETHLlamaRisk, Elliptic 29 OctTether freezes USDT (later more than $1.567B); Circle freezes more than $800M USDCTether and Circle CEOs, via CNBC and Decrypt 29–30 OctAave freezes lending markets; later says markets are unfrozen and contracts unaffectedDecrypt, The Block 30 OctBinance puts the loss at about $6.3B and says it will cover all user lossesBinance, via CNBC and The Hacker News 31 Oct, 00:00New Proof of Reserves snapshot takenBinance email to users, 31 Oct 31 OctAbout 90% of affected assets replenished (up from about 80%); ten major tokens backed at 100%Binance email to users, 31 Oct 1 Nov (planned)Withdrawals due to reopen, per Binance; not yet confirmedBinance email to users, 31 Oct About 3 Nov (expected)Zero-knowledge proof for the 31 Oct snapshot, so holders can verify 1:1 backingBinance email to users, 31 Oct ## What security leaders should do this week - Know which of your assets can be frozen and which cannot. If your organisation holds crypto, map which tokens an issuer can freeze and which only you control, and plan recovery for each. - Treat hot wallets as crown jewels. Keep the minimum online, require multiple approvals for large movements, and alert on any unusual approval or signing pattern. - Check exchange exposure. If you hold funds on Binance, follow only Binance's official channels. Binance had announced no claims process as of its 31 October update; treat any "compensation form" or request for a seed phrase as a scam. - Warn staff about reopening scams. Binance says it will never ask for a password, one-time code or seed phrase. Expect phishing timed to the 1 November withdrawal reopening and the Proof of Reserves check. - Rehearse the first hour. Here the freezes worked only because issuers acted within hours. Know who you would call, and what you would ask them to freeze, before you need to. - Brief the board on speed, not just size. The difference between frozen and lost money was measured in minutes. ## Frequently asked questions ### Was Binance hacked? Yes. Binance says about $6.3 billion in assets were affected when its hot wallets were drained on 29 October 2026, and that it will cover all user losses from its SAFU fund and company funds. It found no evidence of a wallet private key leak and will publish a post-mortem. ### How much did Tether and Circle freeze? Tether CEO Paolo Ardoino said Tether froze more than $1.567 billion of USDT linked to the incident. Circle CEO Jeremy Allaire said Circle froze more than $800 million of USDC with law enforcement. ### What did the hacker do on Aave? According to LlamaRisk and Elliptic, the attacker deposited 60 million USDT into Aave as collateral and borrowed 19,762 WETH, worth about $44.6 million, about 40 minutes before the first freeze. ### Why could the hacker keep the ether? Tether and Circle can freeze their own tokens; ether has no issuer and no freeze function. Once the value was in borrowed ETH, freezing USDT no longer reached it. ### Did Aave lose money? LlamaRisk said Aave suppliers were not at risk because the loan was over-collateralised. Aave later said its contracts were unaffected. ### Has Binance replaced the stolen funds? Partly. In an update emailed to users on 31 October 2026, Binance said about 90% of affected assets had been replenished, up from about 80% in its previous update, and that BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC were backed at 100%. Binance said the money came from a partial deployment of its SAFU fund, part of its Futures Insurance Fund and its corporate treasury, and that the remaining 10% is less liquid tokens outside the top ten that it is still buying. ### When will Binance withdrawals reopen? Binance said in its 31 October update that it remained on track to reopen withdrawals on Sunday 1 November 2026 and would confirm details through its official channels. It had not confirmed the reopening as of that update. ### Who is behind the Binance hack? Not confirmed. Cointelegraph and some analysts have linked it to the North Korean group TraderTraitor; Binance and law enforcement had not confirmed an attribution as of 31 October 2026. ## Practise the response Sequence the first decisions in the [IR Playbook Lab](/tools/ir-playbook-lab), draft what you would say publicly with the [incident holding statements](/tools/incident-holding-statements) tool, and build the plan you would need with the [incident response plan builder](/tools/incident-response-plan-builder). For the question of what certifications are worth, see [Certified and breached](/blog/certified-and-breached-2026-soc2-iso27001). ## Sources - CNBC: $6.3 billion Binance hack is largest crypto theft on record - The Block: Inside the largest crypto hack on record - CoinDesk: Binance loses over $6 billion - Decrypt: Binance hacker hunts for exit ramps as DeFi exchanges pause markets - crypto.news: Aave market freezes and the claimed $60M hacker loan - Cointelegraph: Binance's record $6.3B hack as it happened - The Hacker News: Binance suffers security breach affecting $6.3 billion - Binance: update emailed to users, 31 October 2026 (replenishment, Proof of Reserves snapshot, withdrawal timing) - CNBC: Investigators in a "cat and mouse game" to recover stolen funds