- Tether says it froze more than $1.5bn of USDT linked to the 29 October Binance hack within 30 minutes, and that the FBI has attributed the attack to North Korea. The figures and the timing are the company’s own, published in its press release and not independently verified.
- A freeze is not a recovery. The stay in the attacker’s wallet and simply stop being transferable, and nothing in the release says they are going back to Binance or its customers.
- The same blacklist function works on any address holding USDT, without notice and without a court order.
Tether published a press release on Monday saying it froze more than $1.5bn of its own dollar tokens within half an hour of last week’s Binance hack, money the FBI has linked to North Korea. The freeze happened. What it achieved is narrower than the announcement makes it sound.
A is a token designed to stay worth about a dollar, and the company that issues it can switch off any wallet that holds it. This week Tether pointed that power at a thief, which is the version of it everybody approves of. The same function works on an ordinary holder’s address, with no warning, no judge involved and no appeals process for a UK reader to apply to. Every pound you hold in USDT sits on that arrangement, whichever side of it you expect to be on.
What a freeze actually does
USDT is not a coin in its own right. It is a token issued by Tether and run as a piece of software on other networks, and that software includes a blacklist. When Tether adds an address to it, the balance stays exactly where it is and stops being able to go anywhere.
So the stolen tokens have not been seized, forfeited or handed back. They are sitting in an attacker’s wallet, unspendable. Tether does have a separate process where it destroys frozen tokens and reissues them to law enforcement, and the release says about $1.2bn has been returned to victims and authorities that way over the company’s lifetime. It does not say that is happening here.
That distinction matters most to Binance customers, who are currently being let back into their accounts in phases while the exchange works through its security checks. Money that is frozen is money that is out of circulation, not money that has come home.
Why the rest of the haul kept moving
The Tether release does not give a figure for the full theft. Secondary coverage, and the FBI’s own alert page, put it at roughly $6.3bn, which would make the frozen portion somewhere under a quarter of what went missing.
The reason is the asset mix rather than anyone’s reaction time. Stolen ether and XRP are native assets with no issuing company behind them, so there is no switch to flip. A stablecoin has a company, a compliance department and a blacklist, and anything held in one can be stopped in minutes by a single party.
You can see the same logic in a stranger form elsewhere in the clean-up. CoinDesk reported that a 12-person Arbitrum council briefly rewrote one of the network’s core contracts to move $30m of the stolen funds out of an address it held no key for, then put the code back. Where somebody has the power to intervene, the money tends to stop. Where nobody does, it keeps going.
The claims are Tether’s own
“We have always said that USD₮ is the worst possible choice for criminals, and the Binance’ hack response shows why,” Paolo Ardoino, Tether’s chief executive, said in the release. “Within minutes of the hack, our team had frozen more than $1.5 billion. The FBI has confirmed North Korea was behind the attack.” Bo Hines, who runs Tether’s US arm, called the freeze “a direct contribution to U.S. and global security”.
This is a company describing its own performance, in a document that also brands Tether “the largest company in the digital asset industry”, bundles in several unrelated past freezes under the heading “A Track Record of Swift Action”, and ends by pointing readers at a Tether-run facts site. The underlying action looks real and the attribution has been reported by several outlets independently. But the amount, the half-hour timing and the lifetime totals of $7bn frozen all come from Tether and nowhere else, analysis cited by other outlets suggests the first freeze landed closer to 40 minutes to an hour after the attack transactions, and the FBI alert page the release links to was not reachable when we checked it.
Set against Bybit
The comparison worth making is February 2025, when the same North Korean operation took roughly $1.5bn from Bybit. That money went into bitcoin and through mixing services within days, and the great majority of it was never recovered. Almost nothing about the response was faster or slower this time. The difference is what the thieves happened to grab.
Which is the uncomfortable half of a good news story. The part of your money that can be rescued from a hack is the part that somebody else can freeze at will, and holding your own keys protects you from an exchange failure without doing anything at all about a token issuer’s blacklist.
What to watch
Whether the $1.5bn is ever reissued to Binance or its customers, or just stays frozen indefinitely. That is the line between a recovery and a containment, and only a formal seizure or reissuance settles it.
Also worth watching: whether an independent on-chain account of the timing emerges, and whether Binance covers customer losses in full as withdrawals reopen. Our earlier coverage of the attribution and the hack itself is in the news archive.