Binance Says $3 Billion Is Now Frozen — and a Layer-2 Council Just Joined the Hunt
The numbers in the Binance incident keep moving, and the latest move is in the direction victims want to see. In an official update on X at 00:52 UTC on October 30, Binance said the current verified total frozen in connection with the hack is around $3 billion. That is roughly $460 million more than the $2.54 billion it reported at 23:22 UTC on October 29 — about $5 million a minute over ninety minutes, as tracing teams, issuers and blockchain-intelligence firms kept finding and locking attacker-linked funds. The frozen total is official. The amount actually stolen is still not confirmed by Binance itself, and the gap between the two figures is where the story now lives.
From $2.54 billion to $3 billion in ninety minutes. Binance's own sequence tells the story of a fast-moving recovery effort. Founder Changpeng Zhao first pointed to Tether freezing about $971 million and Circle freezing about $873 million in stablecoins. Tether chief executive Paolo Ardoino later put Tether's freeze above $1.567 billion in USDT, and Circle chief executive Jeremy Allaire said Circle had frozen more than $800 million in USDC in coordination with law enforcement. Binance then reported a verified frozen total of $2.54 billion late on October 29, cautioning that the figure could rise as work with law enforcement, issuers and industry partners continued. It did — to around $3 billion by 00:52 UTC on October 30, with Binance saying it would publish further figures once verified. Ripple has also frozen holdings of its RLUSD stablecoin linked to the incident, and World Liberty Financial froze $27 million in its USD1 token. Aave froze lending markets so the attacker could not borrow against the stolen funds. The pattern is consistent: anything an issuer can freeze, is being frozen.
The freeze that was not a stablecoin freeze. The most interesting new freeze did not come from a stablecoin issuer at all. Binance co-chief executive Yi He said on X at 00:24 UTC that the Arbitrum Security Council had executed a transaction to freeze about $30.5 million from the Binance exploit — 74.56 million ARB tokens plus 8,425 ETH — moving them to an intermediary frozen wallet. The council said the funds can now only be moved by further action of the Security Council or a vote of Arbitrum DAO governance, and that the action was taken without impacting any Arbitrum users or applications. At roughly 1% of the $3 billion frozen total, the amount is small. Its significance is not. A layer-2 network's governance body used an emergency power to lock funds tied to an exploit on another platform's wallets. Supporters will call that the system working as designed — a safety valve for exactly this kind of event. Critics will ask a harder question: if a council can freeze $30.5 million today on its own authority, what constrains that power tomorrow? That debate about how much emergency control decentralised networks actually keep is now part of this incident's legacy, whatever the final loss figure turns out to be.
Frozen is not recovered — and the loss figure is still open. Three numbers must not be confused. First, the frozen total: around $3 billion, verified by Binance, and still rising. Second, the outflow estimates from on-chain analysts: Chainalysis puts the amount stolen at $5.912 billion at the time of theft — roughly four times the $1.5 billion Bybit theft of February 2025, previously the largest confirmed crypto heist. Arkham data cited by KuCoin puts addresses associated with the hack at about $5.875 billion across 65 tokens, while FinanceFeeds' on-chain review tracked about $3.3 billion leaving Binance hot wallets on Ethereum and Decrypt tallied at least $5.57 billion across Ethereum, Bitcoin and Tron. Third, the net loss: still unconfirmed by Binance, which says it will only share confirmed figures. Frozen stablecoins stay where they are until the issuer reissues or burns them, usually after law enforcement or a court confirms ownership — so frozen is a step toward recovery, not recovery itself. Bitcoin and ether cannot be frozen at all, which is why the unfrozen remainder matters so much. Against that backdrop, the most practical fact for ordinary users is simpler: Binance has temporarily suspended deposits and withdrawals on multiple networks while it investigates, a halt that began at 22:15 UTC on October 29, with no reopening time given and a full post-mortem promised once the investigation is complete.
What to watch next. Three figures will settle this story. The next verified frozen total — whether it keeps climbing toward the outflow estimates or plateaus. Binance's own confirmed loss figure, which it has not yet published. And the reopening timeline for withdrawals, which is what most Binance customers actually feel. Until those land, the honest summary is this: about $3 billion is locked down and cannot move, several billion more is estimated to have left, and the difference between those two numbers is still being traced, wallet by wallet.
FAQ: How much is frozen now? Around $3 billion, per Binance's verified update at 00:52 UTC on October 30, up from $2.54 billion about ninety minutes earlier. What did Arbitrum freeze? About $30.5 million — 74.56 million ARB plus 8,425 ETH — moved by the Arbitrum Security Council to a frozen wallet, releasable only by the council or an Arbitrum DAO governance vote. How much was stolen? Not confirmed by Binance. Chainalysis estimates $5.912 billion at the time of theft; other on-chain tallies range from about $3.3 billion on Ethereum alone to at least $5.57 billion across chains. Does frozen mean recovered? No. Frozen assets stay put until issuers reissue or burn them, usually after law enforcement or a court confirms ownership. Can users withdraw yet? Deposits and withdrawals remain suspended on multiple networks since 22:15 UTC on October 29, with no reopening time announced. Has Binance confirmed the cause? No — it says it is investigating a potential security issue and will publish a full post-mortem when the investigation is complete.
For more market news and discussion, follow Zimbuck News at https://zimbuck.com/pages/zimbucknews and join the Zimbuck Market News group at https://zimbuck.com/groups/zimbuckmarketnews. Related reading: https://zimbuck.com/blogs/416/How-One-Signature-Emptied-a-Binance-Hot-Wallet-the-EIP
This article is market news and general information only, not financial advice.
