Original | Odaily Planet Daily (@OdailyChina)
Author｜Azuma (@azuma_eth)
In the early hours of this morning, Binance's hot wallets suffered the largest security breach in cryptocurrency history. Within less than an hour, Binance hot wallets across multiple networks including Ethereum, Bitcoin, Tron, as well as Arbitrum, Avalanche, Optimism, Base, and others were simultaneously compromised, with cumulative outflows approaching $6.3 billion (as confirmed in Binance's latest announcement).
Following the attack, major stablecoin issuers, RWA asset issuers, and public chain protocols launched the largest joint on-chain interception operation in crypto history.
As of 8:52 Beijing time, Binance officially updated the incident handling progress, stating that the total amount of stolen assets confirmed frozen is approximately $3 billion. Binance also stated that the team continues to work closely with law enforcement agencies, asset issuers, blockchain intelligence companies, and industry partners to trace and freeze more assets, and will only publish verified data going forward.
Combining the community's latest on-chain tracking dashboard data (source: ZachXBT) and timeline records, we have compiled the 11 types of assets confirmed to have been frozen by various institutions/protocols as of the time of publication.
Breakdown of the Freezing Operation: Who Is Acting? How Are They Intercepting?
This on-chain interception of up to $3 billion mainly relies on the built-in blacklist or freeze administrator permissions of centralized stablecoins and yield-bearing asset smart contracts, and can be specifically divided into the following four major categories.
Stablecoin Duo: Tether and Circle Lock Down Nearly $2.6 Billion
- Tether (froze over $1.809 billion)
On-chain records show that just 41 minutes after Binance 14 was first swept at 4:24 Beijing time, Tether took the lead at 5:05 by calling the blacklist function on-chain, initially locking 971 million USDT, and at 5:11 expanded the freeze to 1.567 billion USDT.
Subsequently at 5:25, Tether CEO Paolo Ardoino officially posted on X confirming that over 1.567 billion USDT related to the Binance incident had been frozen. With the subsequent blacklisting of additional associated addresses, current on-chain statistics show that a total of 1,767,593,979.80 USDT has been completely locked down.
At the same time, Tether also blacklisted 12,574.05 XAUT (gold token, approximately $35 million) that the hacker casually swept out, as well as 6,185,900.10 USDT0, a cross-chain stablecoin.
- Circle (froze $823 million)
After Binance 34 outflowed a total of 823 million USDC at 4:41 and 4:59, Circle completed the on-chain address blacklisting at 5:13. Subsequently at 5:28, Circle CEO Jeremy Allaire officially posted on X confirming that over 800 million associated USDC had been frozen in coordination with law enforcement.
According to the latest on-chain statistics, the stolen 823,000,000 USDC has been fully frozen in the hacker's addresses.
Emerging Stablecoin Issuers: Ripple, WLFI, Paxos, and StraitsX Join the Siege
In addition to the two largest stablecoin giants, some other emerging stablecoin issuers have also participated in the siege against the hacker.
- Ripple: Has frozen 40,541,065 RLUSD (approximately $40.54 million) in the hacker's addresses;
- World Liberty Financial: Froze 27,824,039.94 USD1 (approximately $27.82 million), as well as 48 million WLFI tokens (approximately $2 million);
- Paxos: Simultaneously froze 215,657.65 USDP (approximately $215,000) of its issued stablecoin and 1,906.67 PAXG (approximately $5.3 million) of its gold token;
- StraitsX: Singapore-compliant stablecoin issuer StraitsX froze 819,820.54 XUSD (approximately $820,000).
Binance's Proprietary Wrapped Assets: Nearly 30,000 WBETH Locked in Place
Among non-stablecoin assets, the hacker swept 29,934.01 WBETH (Wrapped Beacon ETH, worth nearly $80 million to $100 million) from Binance 14.
Since WBETH itself is a liquid staking wrapped token officially issued by Binance, its underlying smart contract has administrator restriction permissions. Binance's security team immediately froze this batch of WBETH through internal permissions after the incident, and the hacker can no longer unstake or sell it.
Public Chain Ecosystem Containment: 74.56 Million ARB Restricted from Moving
In addition to the assets directly frozen through token contract blacklists mentioned above, some other public chain (L1 & L2) ecosystems are also actively taking emergency measures to contain the situation.
At 8:19 Beijing time this morning, the Arbitrum Security Council officially announced that it had taken emergency action to transfer 74,559,805 ARB and 8,425 ETH held in addresses identified as related to the Binance hack incident to an intermediate frozen wallet. The addresses that originally held these funds can no longer access them, and they can only be transferred through further action by the Security Council or an Arbitrum DAO governance vote, with relevant matters to be coordinated with all parties.
Follow-up Tracking Focus
With approximately $3 billion of stolen funds frozen, the vast majority of the stablecoin assets in the hacker's hands have been brought under control.
Currently, the core focus of on-chain tracking and offense-defense has fully shifted to native crypto assets that cannot be directly frozen through contracts — mainly including approximately 195,000 ETH still circulating or dormant on-chain (some of which have been deposited by the hacker into Aave to borrow WETH in an attempt to launder) and 18,270 BTC on the Bitcoin network.
Regarding the on-chain abnormal movements of the remaining unfrozen funds and the progress of judicial recovery, Odaily Planet Daily will continue to maintain follow-up reporting. With the entire network closing in, which dirty funds have been frozen in the Binance theft incident?
