On 29 October 2026 at 20:24:23 UTC, one transaction moved 1.62 billion USDT and 62 other tokens out of the Binance wallet tagged Binance 14. Thirty-seven minutes later Tether blacklisted the receiving address, and by 00:46 UTC four issuers had blacklisted it on four chains, freezing $1.81B. This is what our freeze ledger recorded, minute by minute.
The FBI attributed the theft to North Korea's TraderTraitor group in an alert published on 31 October, which puts the total taken from Binance above $6 billion. This page covers one part of it: the stablecoins, where the issuers can act, and what they did.
37 minutes 12 seconds from drain to first freeze
The drained funds landed on a single address, and part of them later moved to a second one. Tether moved first, Circle three minutes later, then the other chains and issuers through the night. Every row links to the issuer's transaction.
- 29 Oct 20:24:23One transaction moves 1.62B USDT and 62 other tokens out of the wallet tagged “Binance 14”Receiver: 0x5227f603…2f8c, tagged “Binance Hot Wallet Exploiter 2” by Etherscan.tx ↗$1.62B USDT
- 29 Oct 21:01:35Tether blacklists 0x5227f603…2f8c on EthereumUSDT balance at the freeze: $971,149,299.48tx ↗$971.15M
- 29 Oct 21:04:59Circle blacklists 0x5227f603…2f8c on EthereumUSDC balance at the freeze: $823,000,000.00tx ↗$823.00M
- 29 Oct 21:07:55Tether blacklists 0x5227f603…2f8c on AvalancheUSDT balance at the freeze: $8,409,928.40tx ↗$8.41M
- 29 Oct 22:30:47Paxos blacklists 0x5227f603…2f8c on EthereumUSDP: no balance on that chain at the freezetx ↗$0
- 29 Oct 23:25:39Tether blacklists 0x5227f603…2f8c on PolygonUSDT balance at the freeze: $6,185,900.10tx ↗$6.19M
- 30 Oct 00:42:26First Digital blacklists 0xb3ddec0c…5fdb on BSCFDUSD: no balance on that chain at the freezetx ↗$0
- 30 Oct 00:42:26First Digital blacklists 0x5227f603…2f8c on BSCFDUSD: no balance on that chain at the freezetx ↗$0
- 30 Oct 00:46:11First Digital blacklists 0xb3ddec0c…5fdb on EthereumFDUSD: no balance on that chain at the freezetx ↗$0
- 30 Oct 00:46:11First Digital blacklists 0x5227f603…2f8c on EthereumFDUSD balance at the freeze: $3,454,894.92tx ↗$3.45M
- 30 Oct 01:06:47Circle blacklists 0xb3ddec0c…5fdb on EthereumUSDC balance at the freeze: $33,005.12tx ↗$33,005
Where the frozen dollars sit
The USDe the blacklists could not reach
Tether and Circle can only freeze their own tokens. The drain also took 9,707,547 USDe, a stablecoin neither of them issues. At 22:56:47 UTC, almost two hours after Tether and Circle had frozen the receiving address, the full USDe amount moved on to 0xb3ddec0c…5fdb. From there it left again in 179 transfers between 22:58 and 02:11 UTC, down to the last decimal: 8,555,618 into a USDe/USDC pool, the rest to two other addresses.
USDe (6,882,351.93, in 62 transfers) left that address after Circle had blacklisted it at 01:06:47 UTC. A Circle blacklist stops USDC, not every token on the address.
Issuers also blacklisted Binance's own wallets
Two of the blacklisted addresses belong to Binance, according to their Etherscan tags. These are issuer actions on an exchange wallet during an incident, not a measure against Binance by any authority: Circle blacklisted the wallet tagged “Binance: Hot Wallet 34” on 6 chains within 38 seconds, holding $62,956,105.66, and Tether blacklisted “Binance 14”, the drained wallet itself, with $1,351,530.01 in USDT left on it.
More freezes, on addresses tagged by others
These addresses are tied to the theft by a third party, not by a transfer we traced. We list them with their source.
| Address | Attribution | Freeze (UTC) | Issuer | Balance |
|---|---|---|---|---|
| 0xa97bf783…8d10 | Binance Hot Wallet Exploiter 22 (Etherscan) | 30 Oct 00:09:23 | Paxos USDP | $215,657.65 |
| 0xa97bf783…8d10 | Binance Hot Wallet Exploiter 22 (Etherscan) | 30 Oct 04:11:35 | Circle USDC | $123,175.53 |
| 0x29482870…a0ed | FBI alert, 31 Oct 2026 (FBI) | 30 Oct 13:27:59 | Circle USDC | $0.00 |
So the case has two different “last freezes”: the last one that locked a balance was at 30 Oct 04:11:35 UTC ($123,175.53), and the last freeze on any address tied to the case was at 30 Oct 13:27:59 UTC, on an empty address.
The FBI list is not a sanctions list
The FBI alert lists 608 Ethereum addresses, plus Bitcoin and Solana addresses, and asks exchanges, DeFi services and analytics firms to block them. We loaded them on 1 November. Two facts matter for anyone screening against them:
- None of the 608 is on a sanctions list we track (OFAC SDN, Israel MOD, UK FCDO, Japan MOF, France Trésor and the EU Official Journal, read from the authorities' own files). A law-enforcement alert is an attribution, not a designation, and should not be reported as a sanctions hit.
- Only 1 of them has been blacklisted by a stablecoin issuer so far, and it held nothing at the time. The frozen dollars sit on addresses the alert does not list.
How to read these numbers
Source
Blacklist events emitted by the issuer contracts, recorded in our freeze ledger, with block timestamps in UTC. The ledger covers USDT, USDT0, USDC, EURC, USDP, USDG and FDUSD; it does not cover USDe.
Grouping
An address is “linked” only when an on-chain transfer chain from the drained wallet reaches it. Explorer tags and the FBI alert are listed separately, with their source. Binance's own wallets are kept apart.
Contracts, not symbols
Tokens named “USDT” exist on contracts other than Tether's. Every figure here is read from the issuers' own contracts; flows counted by symbol would include worthless copies.
What we do not say
The ledger records that an issuer blacklisted an address at a given time. It does not record why. Tags such as “Exploiter” are the explorer's attribution, not an identification.
How this compares with a normal quarter
In the whole of Q3 2026, all issuers together froze about $565M across every chain, counting the balances we could read. The freezes on this one address in a single night are more than three times that. Our Q3 report gives the baseline, with open data; the Q4 report, due in January, will include this incident. The day-by-day record is on the Stablecoin Freeze Ledger.
The 28 freeze rows behind this page, with addresses, tags and transactions, are free to reuse under CC BY 4.0: binance-theft-freezes-2026-10.csv.
Newsletter
BA Daily abonnieren
On-Chain-Intelligence in Ihrem Postfach: Freezes, Sanktions-Updates, wichtige Wallet-Bewegungen und die Analysen, die wir veröffentlichen.
Kein Spam. Jederzeit abbestellbar.
Is an address you deal with frozen?
Check any wallet against the Tether and Circle blacklists, free and without an account.