elliptic binance freeze: $2.85B of Stolen Funds Locked

The elliptic binance freeze scoreboard is the cleanest public tally of how much of the late-October Binance theft is actually stuck: Elliptic has verified $2.85 billion frozen or seized out of about $6.43 billion stolen — roughly 44% — with almost all of that locked value in USDT and USDC after issuers raced the attacker. The FBI has attributed the breach to North Korea's TraderTraitor group.

What actually happened

On October 29, 2026, attackers drained Binance hot wallets across 11 blockchains. Elliptic's investigation page puts the verified haul at $6.43 billion, a bit above Binance's roughly $6.3 billion impact estimate, and calls it the largest theft on record — several times larger than the 2025 Bybit case. We covered the exchange-side story in binance 6.3b hack and the FBI naming in fbi tradertraitor binance.

The elliptic binance freeze figure sits inside that narrative. Elliptic says it has verified $2.85 billion of frozen or seized funds on-chain, close to Binance's own "around $3 billion" freeze talk, and that stablecoins make up about 94% of what is locked. Tether, Circle and other issuers blacklisted attacker addresses in the first hours; some L2 governance processes also moved assets out of reach. CoinEdition's November 3 recap repeated the $2.85 billion frozen/seized line and added that about $3.24 billion, mainly ETH and BTC, still sat in attacker-linked addresses as of November 2.

Native assets are the hard problem. Nothing stolen as BTC on Bitcoin, or as several other non-freezable tokens, can be clawed back by an issuer key. That is why the freeze percentage stalled near the mid-40s even after dramatic stablecoin actions, and why laundering shifted toward ETH, bridges and DeFi routes.

How the freeze race unfolded

Elliptic's timeline shows how minutes mattered. Large USDT and USDC balances hit attacker wallets on Ethereum; Tether froze the first major wallet within about 37 minutes, then chased onward addresses; Circle froze the USDC pile minutes later. Other issuers followed on their own tokens. Arbitrum and Optimism governance steps secured some L2 exposures. Those actions produced the $2.85 billion verified total Elliptic cites.

Meanwhile the attacker swapped unfrozen stables for ETH at ugly discounts, borrowed against USDT on Aave before markets froze, and moved Tron-side value through SunSwap and bridges. Elliptic describes automated scripts running around the clock and funds spreading across hundreds of fresh addresses. Cross-chain hops, including paths that touched services also seen in earlier TraderTraitor-linked thefts, are why analytics firms keep publishing blocklists rather than declaring victory.

Binance's customer-facing recovery — phase-one withdrawals on November 1 and the wider reopen on November 3 — is a separate track from the freeze war. Users getting funds out does not increase the $2.85 billion seized from the thief. It only shows the exchange covering client balances from SAFU and company capital while the hunt continues.

What the 44% number does and does not mean

Forty-four percent frozen sounds huge until you remember the denominator. More than half of the haul, on Elliptic's math, remains outside issuer freeze reach or already converted. CoinEdition's later ~$3.24 billion still-mobile figure is the complementary headline traders watch for dump risk. When that pile migrates into ETH or BTC and hits venues, spot can feel it even if the original USDT is long blacklisted.

The elliptic binance freeze page itself was marked as a final update on November 1 at 08:00 UTC, with laundering to be tracked in a follow-on article. Treat the $2.85 billion as the verified freeze stock at that investigative cutoff, then layer newer recap numbers carefully rather than blending them into one fake live ticker.

Attribution matters for compliance teams more than for casual holders. Once the FBI named TraderTraitor, exchanges and DeFi frontends had clearer cover to block listed addresses. Elliptic already offered customer screening against theft-linked wallets. That shrinks on-ramps without magically raising the freeze percentage.

What to do as a reader

Read the primary Elliptic investigation before repeating screenshots. If you operate a venue or a bot that touches bridges, screen against published TraderTraitor and Binance-theft address lists rather than inventing your own heuristics mid-incident. If you are only a user, focus on whether your exchange has restored the pairs you need — see our phase-two coverage — and ignore "guaranteed recovery" DMs.

Watch for updates that change either the frozen stock or the still-mobile pile. The elliptic binance freeze ratio will not climb much unless issuers or law enforcement seize more of the non-stable remainder. Nothing here is investment advice. On-chain tallies revise as labels improve.