The freeze is not a return.
@paoloardoino posted at 21:25 UTC on October 29 that Tether froze more than 1.567 billion USDT related to a potential Binance exchange hack. https://x.com/paoloardoino/status/2115918000373346709. When I read it, that post had 12,201 likes, 1,185 reposts, 1,253 replies, 505 quotes, 423 bookmarks, and 2,502,661 impressions. Seven minutes earlier @jerallaire said Circle had frozen more than 800 million USDC, in coordination with law enforcement. https://x.com/jerallaire/status/2115916207463481846. That one had 4,295 likes, 452 reposts, 632 replies, 172 quotes, 176 bookmarks, and 970,045 impressions. Those balances stopped because the issuers still had a pause. Nobody got a key back.
What they counted
@binance at 23:22 UTC the same night said the public numbers were already apart, including a $1.8 billion figure, and that the verified frozen total was $2.54 billion. https://x.com/binance/status/2115947325617299903. When I read it, 4,916 likes, 908 reposts, 518 replies, 295 quotes, 310 bookmarks, and 786,799 impressions. By 00:52 UTC on October 30 the verified total was around $3 billion, and the post adds that user funds are safe. https://x.com/binance/status/2115970069696217576. 3,755 likes, 625 reposts, 510 replies, 261 quotes, 207 bookmarks, and 777,652 impressions.
The support page uses the same pair. Published 2026-10-30 at 02:23, updated at 11:36. Estimated total impact around $6.3 billion. About $3 billion frozen on-chain. https://www.binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7. The page says the first look points at a compromised DevOps engineer’s laptop, access to a service container, and unauthorized withdrawal transactions. It says they have found no evidence of a wallet private key leak. I have not seen a post-mortem. They said they will publish one when the facts are verified. Until that file exists, no key leak is their finding. It is not something I can check on a block.
Elliptic’s note, updated 08:00 UTC on October 30, counts $6.43 billion stolen and $2.84 billion frozen. That is 44% of their total, and they say almost all of the frozen money is USDT and USDC. https://www.elliptic.co/insights/binance-largest-hack-in-history/. I am not picking between $6.3 billion and $6.43 billion. Both writeups say the money that stopped is the money an issuer could stop. Elliptic also says the attacker is swapping the rest into ETH and other assets that cannot be frozen.
A freeze is an admin call on a token. Bitcoin does not have one. Ether on Ethereum does not have one. If the coin left and no issuer sits above it, there is no pause to hit.
@JackMcDonald posted at 22:08 UTC that Ripple was actively freezing affected RLUSD tied to the attackers. https://x.com/_JackMcDonald_/status/2115928859854221744. I did not pull a like count I trust on that one. Another issuer, another pause, about 40 minutes after Tether.
@heyibinance at 00:24 UTC said the Arbitrum Security Council executed a transaction to freeze about $30.5 million from the exploit. https://x.com/heyibinance/status/2115962957880602653. 1,652 likes, 76 reposts, 181 replies, 11 quotes, 18 bookmarks, and 133,910 impressions. That is not an issuer. It is a council that can still move funds on that chain. I have not opened the transaction. I am not going to describe a mechanism I did not read. $30.5 million is real, and it is small next to $3 billion.
The cover is a balance sheet
The sentence getting quoted is user funds are safe. @heyibinance posted it at 00:04 UTC, and the next line is the cover. Binance will cover all hacking losses. https://x.com/heyibinance/status/2115958049244631357. 7,501 likes, 957 reposts, 1,049 replies, 389 quotes, 360 bookmarks, and 850,638 impressions. The same post says deposits and withdrawals are temporarily suspended while they run security checks and freeze funds. The support page was edited later. A note at the bottom says the announcement was updated on 2026-10-30 to clarify that deposits remain unaffected. Withdrawals are still the paused side. Safe, in that sentence, means the account balance will be honored. It does not mean the coins are still in the hot wallet.
@_RichardTeng at 07:37 UTC opens on the same promise. Your money is safe, and we’re covering every loss. https://x.com/_RichardTeng/status/2116072080525656150. 4,844 likes, 685 reposts, 595 replies, 156 quotes, 585 bookmarks, and 399,996 impressions. He writes that the attacker did not simply use one engineer’s permissions, and that this was not a single one-click action. The investigation has not attributed responsibility to any individual. So far, no evidence of a wallet private key leak. Estimated impact about $6.3 billion, about $3 billion frozen. Deposits operating as normal. Withdrawals suspended while they revamp the withdrawal service and its addresses.
@binance at 08:47 UTC said the later look found additional points of breach, and that outflows ceased when they paused withdrawals. https://x.com/binance/status/2116089661408108712. 4,482 likes, 722 reposts, 664 replies, 318 quotes, 335 bookmarks, and 540,971 impressions. Frozen around $3 billion, still. They said they were on track to resume withdrawals in 45 hours from that post. I am not treating 45 hours as a clock I can set.
The cover shows up as two different sums, a couple of hours apart. I am leaving both of them up.
@cz_binance at 09:33 UTC posted it as a reply, and he called it rough math. A $6.x billion hack, $3 billion frozen, a $1.x billion SAFU fund, a gap of about $2 billion. He wrote that they have $1.x billion in SPCX alone, and that the remaining gap is still painful but manageable. https://x.com/cz_binance/status/2116101255059947839. 9,397 likes, 714 reposts, 1,183 replies, 504 quotes, 662 bookmarks, and 1,151,732 impressions. Rough math is his label. I am not turning it into a ledger. I also do not know what SPCX is from that post, so I am not going to explain it.
At 10:55 UTC the company post is a reservation, not a freeze. They have reserved over $6.34 billion of company funds to cover the incident. $5 billion of that is already held in the exact token assets that were hit. They are buying the rest through market channels and OTC, because some tokens are thin and OTC settlement takes time. https://x.com/binance/status/2116121748555153621. 6,295 likes, 966 reposts, 871 replies, 343 quotes, 308 bookmarks, and 842,950 impressions. The same post says those figures do not include frozen or protected assets. Frozen assets remain subject to ongoing recovery and verification. Currently $3 billion has been frozen. They are working with partners and law enforcement to recover the frozen assets. Company resources cover the confirmed shortfall. Proof of reserves is how they say the balances get checked later.
The $6.34 billion is not the $3 billion. The freeze is a pile they still have to get back. Paying customers is a separate purchase of coins they no longer hold.
A freeze locks a balance at an address. It does not move that balance to Binance. In the company’s own words, recovery of the frozen assets is unfinished. The coins with no freeze function were never in that pile. Those are the ones the reservation is for.
Elliptic puts the February 2025 Bybit theft at $1.46 billion, and this one at more than four times that on their count. I am using that for scale. It does not change which coins had a pause.
If the coin you are waiting to withdraw has a freeze function, the pause last night is why some of that ticker stopped. If it does not, there was no issuer who could stop it. User funds are safe is the exchange agreeing to pay the account. Whether the coin itself stopped depended on whether anyone besides you could freeze it.