Binance hack: who froze $3B, and why DeFi borrowers felt it too

Of the $6.3 billion pulled from Binance hot wallets on the evening of October 29, about $3 billion is now frozen, according to the exchange's own Security Incident Update #2. That is close to half the haul. Stablecoin issuers weren't the only ones reaching for the brake: a layer-2 network and the biggest DeFi lender froze funds too. One of those freezes landed on ordinary users as well.

Who froze what

Stablecoin issuers moved first. Tether froze more than 1.567 billion USDT and Circle more than 800 million USDC (NBC News). Both tokens have a blacklist function built into the contract, and the issuer can call it whenever it decides to.

The Arbitrum Security Council, a body with emergency powers over the network, moved about $30.5 million (74.6 million ARB and 8,425 ETH) from the attacker's address into a frozen intermediary wallet. Those funds can now only be moved by the council itself or by an Arbitrum DAO vote (Cointelegraph).

Aave froze 175 reserves on V3 across 16 networks and 117 on V4 across four (LlamaRisk's write-up on the Aave forum). The trigger: between 20:58 and 21:01 UTC, a wallet in the attacker's cluster supplied 60 million USDT and borrowed 19,762 WETH against it, about $44.6 million. Aave's first freeze landed roughly 40 minutes after that trade.

What can't be frozen

That Aave trade shows the logic of the whole cash-out. Frozen USDT is worthless to an attacker; ETH and BTC have no blacklist. So the first hours were spent swapping what can be frozen for what can't: dumping UNI, LINK and AAVE for ETH on DEXs, and borrowing ETH against USDT. Analyst Dickson Wu estimates the attacker can still move about $3.27 billion in BTC and ETH freely (Cryptonews).

How the Aave freeze hits a regular borrower

A freeze on Aave is not a pause. You can still repay and withdraw, and liquidations keep running. But a frozen reserve takes no new supply, which means you can't post more collateral. LlamaRisk spells it out: while the freeze is on, repaying debt is the only way to raise your health factor.

Picture a borrower with ETH as collateral and stablecoin debt. On October 30, ETH briefly dropped to $2,170 (CoinDesk). The usual move in that spot is to top up with more ETH. For those hours, that move was off the table. No spare stablecoins to repay with, and a liquidator closes the position for you. Withdrawals have their own limit too: you can only pull what the pool has in liquidity, not what's currently lent out (DeFi Prime).

Why freeze everything and not just the stolen tokens? The attacker could swap into any listed asset, so a targeted block would have left doors open. The guardian can lift a freeze on its own, while cutting supply caps would have needed a governance vote and about five days to undo.

What it means for traders

Plenty of systems people call decentralized come with an emergency lever: a guardian multisig, a security council, an issuer's blacklist. This time it was pulled against an attacker. But there is one lever for everyone, and when it's pulled, the rules change for your position too.

The practical takeaway: a DeFi position needs a defense plan that works without adding collateral. That means stablecoins set aside for a partial repayment, or simply less leverage, the things that still work when a protocol stops taking deposits.

Dates to watch: Binance says Proof of Reserves results will be ready by Monday, November 2, and it is buying back the remaining roughly 20% of stolen assets on the market and over the counter (Update #2). Withdrawals from the exchange are still paused.

Daily market data on X: @tarvis_trade