Tether announced on November 2 that it had frozen more than $1.5 billion worth of USDT within 30 minutes of the Binance hack that occurred on October 29. The freeze prevented the stolen tokens from being transferred, swapped or laundered.
FBI attribution
The Federal Bureau of Investigation attributed the theft of over $6 billion from Binance to North Korean cyber activity, designating the operation as “Tradertraitor.” The bureau warned that the stolen assets were being converted primarily into ether and could be further laundered through decentralized finance platforms and instant swap services.
On‑chain activity
On‑chain analysis by Bitquery indicated that Tether’s first freeze was applied 37 minutes after the main Ethereum drain and 57 minutes after the initial transfer. Approximately $729 million of USDT moved before the freeze took effect, with most of that amount swapped into ether and TRX on the Tron network.
Broader freezing actions
Tether said it has frozen more than $7 billion in USDT across secondary‑market addresses linked to fraud and theft. The company also reported cooperation with over 360 law‑enforcement agencies in 73 countries. In April, Tether coordinated a $344 million USDT freeze with U.S. authorities, aligning its policy with the Treasury Department’s OFAC sanctions list.
Binance response
Binance set aside more than $6.34 billion in company funds to replace assets for affected users, excluding roughly $3 billion that was frozen during the response.
Other incidents
Following a $285 million exploit at the Solana‑based platform Drift in April, Tether committed up to $127.5 million toward recovery efforts.
As of October 31, Tether assisted in freezing over 3,590 wallets holding about $1.6 billion for U.S. law‑enforcement agencies and reported that approximately $1.2 billion obtained through fraud and theft had been returned to rightful owners through reissuance.
