As of 30 Oct 2026, about $3 billion has been frozen in connection with the Binance breach of 29 Oct 2026. That headline figure needs careful reading: frozen funds are assets that issuers and others have blocked from moving further, which is a step toward recovery, but it is not by itself proof that the funds have already been returned to Binance or to users.

The largest part of the frozen total is in stablecoins. About $2.3 billion of the frozen amount is in USDT and USDC combined. Stablecoin issuers can freeze tokens at the issuer level in certain circumstances, which is why a large share of the early frozen total sits in those two assets rather than in assets that cannot be frozen in the same way.

Tether accounts for the biggest single freeze reported so far, at more than $1.567 billion in USDT. Circle follows with about $823 million in USDC frozen. Together, those two freezes make up the bulk of the $2.3 billion USDT and USDC figure, and they show how much of the early response depended on issuer action.

Two further freezes add to the total. Ripple froze about $200 million, and World Liberty Financial froze $27 million in USD1. Added to the Tether and Circle amounts, these help explain how the overall frozen figure reaches about $3 billion, while also showing that the response involved more than one issuer.

The frozen total should be set against the estimated size of the breach. The estimated impact is about $6.3 billion, described as the largest crypto theft on record, surpassing Bybit's $1.5 billion in 2025. On that preliminary comparison, about $3 billion frozen would be under half of the estimated impact, but both the impact figure and the frozen figure are preliminary and may change as the investigation continues.

What happened in the breach itself is still under preliminary investigation. Reports say a compromised DevOps engineer's laptop may have let an attacker access a service container and submit unauthorised withdrawal transactions, with no evidence so far of a wallet private key leak. A wallet called Binance 14, in Binance's 1 Oct proof of reserves, was reportedly turned into a sweeper using the Ethereum feature EIP-7702, with about 204,500 ETH moved and ETH backing falling to near 94 percent from 100 percent.

Binance co-CEO Yi He has said all losses will be covered from company funds plus the SAFU emergency fund, which holds about $1 billion in bitcoin, and that user funds are safe. That commitment is separate from the frozen funds: the SAFU and company-fund route is about covering losses, while freezing is about stopping stolen assets from moving onward.

Deposits and withdrawals were suspended as a precaution, and Yi He said she expects withdrawal resumption to begin within the next 48 hours. Some reports say deposits were unaffected, a discrepancy that has not been settled with certainty in the available facts. Attribution is an investigators' claim, not a court finding, with TRM Labs tracing the incident to the North Korean unit TraderTraitor and other trackers also pointing to North Korea, while Pyongyang has previously denied hacking allegations.

FAQ: How much has been frozen? About $3 billion so far, including $2.3 billion in USDT and USDC. Who froze the largest amounts? Tether froze more than $1.567 billion in USDT and Circle froze about $823 million in USDC. Does frozen mean recovered? No, frozen means blocked from further movement, and the next proof-of-reserves snapshot on 1 November 2026 will show whether stolen assets were replaced.