Live Updates: Binance says $2.54 billion frozen after hack

The incident involved suspicious transfers from a Binance-linked Ethereum wallet and wallets associated with the suspected hacker. Binance investigated the breach while analysts tracked the assets. The key question was not only what moved, but how much could be stopped before being sold or transferred again.

When an asset is frozen, its movement is restricted. Stablecoin issuers can block specific token addresses, preventing those tokens from being transferred or redeemed through the issuer. Binance said the verified frozen total reached $2.54 billion. Ripple also said it was freezing affected RLUSD, without giving an amount.

The freeze does not automatically prove that every linked asset was stolen. Binance said the total could rise as investigators trace more assets. The incident did not impact Binance.US, and Binance said it expected user funds to be fully covered. Investigators, issuers, exchanges, and blockchain intelligence firms continued coordinating to identify and contain funds.

The three figures measure different stages of the incident. The $5.84 billion estimate came from Arkham Intelligence’s tracker and represented assets held across wallets labeled as linked to the hack. It was not a confirmed estimate of stolen funds. The $2.54 billion figure was Binance’s verified total of assets frozen in connection with the incident.

The $3.3 billion figure came from Blockaid and counted suspicious transfers involving Binance-linked wallets across Ethereum, Arbitrum, and Avalanche. A transfer can be suspicious without representing a final loss. Assets may also move between wallets, remain unsold, belong to other parties, or later be frozen.

Therefore, the figures cannot be added together or directly compared as losses. Binance said the frozen total could increase as teams trace more assets. Arkham’s wallet total and Blockaid’s transfer total remained tracking measures, while the final loss was still undetermined.

Several companies and platforms helped contain assets linked to the suspected hack. Tether and Circle froze large amounts of USDT and USDC. Ripple froze affected RLUSD. World Liberty Financial froze USD1 and WLFI, working with BitGo. Aave temporarily paused certain lending markets after a linked wallet deposited USDT and borrowed ETH.

Binance investigated the suspicious activity and worked with law enforcement, token issuers, blockchain intelligence firms, and industry partners. Blockchain researchers and analysts identified transfers, labeled wallets, and estimated holdings. Arkham tracked linked wallets, while Blockaid measured suspicious transfers across several networks. These groups provided different pieces of the investigation.

Law enforcement helped coordinate the response, according to the companies’ statements. Binance said it would publish further verified figures as tracing continued. The response therefore combined exchange investigation, public-chain analysis, issuer controls, lending-protocol restrictions, and official investigative support.

Public blockchains record transactions openly, but a token’s rules are set by its smart contract. For many issuer-backed stablecoins, that contract includes administrative functions controlled by the issuer. One such function can place an address on a blocklist or otherwise prevent transfers. This is the practical meaning of freezing a token balance.

The article gives several examples. Tether and Circle froze tokens connected to the suspected incident. World Liberty Financial froze $27 million in USD1 and $2 million worth of WLFI. Ripple said it was actively freezing affected RLUSD, although it did not disclose the amount. These actions targeted token balances or addresses, not the entire blockchain.

The issuers could act because they control relevant token systems, while blockchain records helped them identify where assets moved. Binance said it was coordinating with issuers, investigators, and intelligence firms. The article does not describe each issuer’s technical procedure, so the smart-contract explanation reflects established crypto infrastructure.

Freezing aims to stop suspected stolen tokens from moving through supported token systems. If an issuer blocks an address, its tokens can remain visible on the blockchain but cannot normally be transferred or redeemed through that issuer. The article does not state that every stolen asset was frozen, so some funds could remain under investigation.

Aave responded differently because it is a lending protocol. After a wallet linked to the hack reportedly deposited 60 million USDT and borrowed 19,762 ETH, Aave temporarily froze its v3 and v4 lending markets. The pause made further supply, borrowing, and rate swaps unavailable for affected assets.

Aave said users could still withdraw funds and repay debt. This limited new activity without shutting every function. Binance and investigators continued tracing assets, and the frozen total could increase. The article does not state the final recovery amount or how long the lending-market restrictions would last.

A wallet balance is not the same as a confirmed loss. Arkham’s $5.84 billion figure covered digital assets held by wallets labeled as linked to the hack. The article explicitly says this was a reported holdings figure, not a confirmed estimate of stolen funds. Some assets may have had another status or connection.

The $3.3 billion figure also counted suspicious transfers, rather than a final loss. Transfers can describe movement between addresses without showing whether assets were sold, recovered, frozen, or counted elsewhere. Stablecoin issuers froze substantial amounts, including the $2.54 billion total later verified by Binance. That containment can reduce the amount permanently lost.

Binance said the final frozen total might increase as investigators trace more assets. It also said user funds were expected to be fully covered. Until investigators establish ownership, movement, and recovery, the wallet figure should be treated as an upper tracking figure, not a loss calculation.

A cryptocurrency exchange is a service where users can buy, sell, or hold digital assets. A blockchain wallet is software or hardware that controls addresses and authorizes transactions. The blockchain records those transactions. In the incident, Binance was the exchange linked to the investigated activity, while analysts tracked wallets and transfers.

A stablecoin is a cryptocurrency designed to maintain a stable value against an asset such as the US dollar. USDT, USDC, RLUSD, and USD1 are examples named in the article. A smart contract is code deployed on a blockchain. It can define how tokens move and may include issuer controls that support freezing specific addresses.

In a typical transaction, a wallet signs an instruction to a smart contract, which checks its rules and records the result on the blockchain. An exchange may help a user obtain or trade the token. If an issuer freezes an address, the blockchain remains public, but the token contract can reject or restrict later movement.