On Thursday evening, somebody moved roughly six billion dollars out of the largest cryptocurrency exchange in the world.
Within minutes, two companies you have probably never thought about froze about $2.4 billion of it in place.
Not a court. Not a regulator. Not a police force. Two private companies, each of which pressed a button inside a piece of software, and the money stopped moving.
That is the part of this story worth your time. Not the theft. The button.
Because that button is not reserved for emergencies. It gets pressed roughly four hundred times a month, mostly on people you will never read about, and at least one of them is currently suing over it.
What actually happened Thursday night
Here is the sequence, and I am going to be careful about what is established and what is not, because this story is twenty-four hours old and parts of it have already changed.
At about 9:15 pm UTC on October 29, Binance said it was investigating a potential security issue. A blockchain researcher had already flagged large transfers out of a wallet linked to the exchange.
Binance's current estimate of the total impact is $6.3 billion. The analytics firm Chainalysis put the figure at $5.912 billion valued at the moment it moved. Those do not match, and nobody should pretend they do.
Binance has suspended withdrawals. Its estimate for restarting them has moved three times in a day, from forty-eight hours to forty-five to forty. Co-chief executive Richard Teng said the company will cover all losses using its emergency fund plus company money, and Binance says it has set aside more than $6.34 billion, including $5 billion already held in the same tokens that went missing.
On cause, Binance's first explanation was a compromised laptop belonging to one of its engineers. It has since said it found "additional points of breach" and that this was a multi-step attack rather than one action. Teng pointed to a technical mechanism called an EIP-7702 delegation that, in his words, "did not pass through our normal approval controls." The company says there is no evidence any private key leaked.
I am flagging that explicitly because a company revising its own account of a breach three times in twenty-four hours has not finished finding out what happened. Anything you read today about how this was done is provisional.
On who did it: three separate analytics firms have attributed the attack to a group they associate with North Korea. No government has confirmed that. Private attribution by forensic firms is evidence, and it is often right, but it is not the same thing as a finding, and I am not going to print it as one.
Now the interesting part
While all of that was unfolding, something else happened very fast.
Tether, the company behind the USDT token, froze over $1.567 billion. Its chief executive announced it publicly.
Circle, the company behind USDC, froze over $800 million, saying it acted in cooperation with law enforcement.
Then the rest followed. World Liberty Financial froze $27 million of its USD1 token and about $2 million of another. Ripple froze its RLUSD stablecoin, around $40 million by one firm's count. First Digital froze its FDUSD. The Arbitrum network's security council forcibly moved about $30.5 million of tokens. The lending platform Aave shut down two of its markets entirely as a precaution and reopened them the following afternoon.
Binance's own tally of verified frozen assets reached $3 billion by about 12:52 am UTC.
So roughly half the stolen money was immobilized within hours, by private companies, acting on their own initiative, with no court order in hand.
Think about what that requires to be possible.
What a stablecoin actually is, and what its issuer can do
This is the concept everything else rests on, and almost nobody explains it, so let me.
A stablecoin is a token designed to be worth exactly one dollar, always. USDT and USDC are the two biggest. USDT alone has roughly $180 billion in circulation. They exist because moving actual dollars between banks is slow and closed on weekends, while moving a token takes seconds and never closes.
Here is the part that matters. A stablecoin is not a dollar. It is a claim on a company.
When you hold USDT, what you own is a promise from Tether that it will give you a dollar for it. Tether holds reserves, mostly short-term government debt, to back that promise. The token is the receipt.
Compare that with bitcoin. Bitcoin has no issuer. There is no company behind it, no office, nobody to call. If you control the keys, you control the coins, and there is no mechanism on earth by which some third party reverses that.
A stablecoin is the opposite. There is a company. And a company that can issue a claim can also decide the claim is void.
So here is the button.
The USDT token is a program running on a public network. Inside that program is a list.
The list is literally called a blacklist, and three functions control it: one that adds an address, one that removes an address, and one that destroys the balance of an address on the list.
Only Tether can call them. When Tether adds your address, the effect is immediate and absolute: any attempt to move USDT out of that address fails. The tokens are still recorded as yours. They simply cannot go anywhere, forever, unless Tether changes its mind.
Circle operates an equivalent mechanism on USDC.
That is the whole thing. No lawsuit, no hearing, no notice. One transaction from the issuer, and a balance becomes permanently immobile.
And the destroy function is the part people find genuinely startling once they understand it. Tether can erase a blacklisted balance and reissue the same quantity of tokens to a different address, typically one a court has designated. The total supply does not change. The money has effectively been moved from one owner to another without the first owner ever signing anything.
That capability is, depending on where you stand, either the most important consumer protection in cryptocurrency or a complete refutation of the thing cryptocurrency was supposed to be. Both readings are defensible and I will come back to that.
This is not rare
Here is the figure that reframes Thursday night.
As of late July this year, Tether had blacklisted 9,597 addresses holding about $5.69 billion of USDT.
Split by network: about $3.71 billion across 6,901 addresses on Tron, and about $1.98 billion across 2,696 addresses on Ethereum. The lists are separate, so an address frozen on one network is not automatically frozen on the other.
The pace: Tether blacklisted 4,163 addresses in 2025, and 2,463 more in the first half of 2026. That works out to something like four hundred a month, which is thirteen a day, which is several times a day, every day, in the background, with no coverage at all.
Tether has said it froze roughly $4.2 billion of what it describes as illicit funds in total, and that it has dealt directly with more than 310 agencies in 64 countries. In April alone it froze $344 million on the Tron network after United States authorities flagged the wallets.
So Thursday was not an exception. Thursday was the ordinary machinery of stablecoins, running at a scale large enough that people finally noticed it.
The case that should give you pause
Now the uncomfortable part, and this is the reason I wanted to write this rather than a hack story.
The freeze mechanism does not distinguish between a thief and somebody who received money from a thief.
If tainted funds pass through your address, your address can end up on the list. You did nothing. You may not even know who sent you the money. You accepted a payment, or completed a trade with a stranger, and now your balance does not move.
In early October, a payments company called Conduit sued Tether in a New York court over $2.76 million of USDT that had been frozen since September 2025. More than a year. Conduit's argument is that Tether has no legal claim to the money and no authority to hold it.
That case will take as long as it takes, and I have no idea how it comes out. But notice what it establishes regardless of outcome: there is no built-in process. There is no hearing you are entitled to, no clock that runs out, no official you can appeal to. The only routes are to ask the company nicely or to sue it.
The data bears that out. In 2025, only about 3.6% of blacklisted addresses were removed from the list at all. The ones that did get removed took a median of about eighteen days, but that figure only describes the small minority that got out. The rest are simply still there.
The historical precedent people cite is the 2021 Poly Network incident, where 33.4 million USDT was frozen for fifteen days and then released. Fifteen days was considered notable. Conduit is at thirteen months.
And there is a real asymmetry between the two big issuers. From 2023 through 2025, Circle blacklisted 372 addresses holding about $109 million. Tether, over a comparable stretch, blacklisted 7,268 addresses holding about $3.29 billion. That is roughly twenty times as many addresses and thirty times the value.
Those two companies are running the same technical capability with visibly different thresholds for using it. If you hold a stablecoin, which one you hold is a decision about whose judgment you are accepting. Almost nobody makes that decision deliberately.
Who is in this business
Worth knowing which public companies have money riding on how this question gets settled, because the answer is more of them every quarter.
Circle Internet Group is the clearest case: USDC is its product, and it is now a public company whose economics depend on stablecoins being trusted enough to hold at scale. Coinbase has a revenue-sharing arrangement tied to USDC and is central to its distribution. PayPal issues its own stablecoin. Block and Robinhood both have crypto operations where stablecoins function as the settlement layer. Visa and Mastercard have both been building stablecoin settlement into their networks, which is to say the incumbents are not sitting this out.
Tether, Binance, Ripple and World Liberty Financial are all privately held, so there is no stock to look at and considerably less disclosure to read. That asymmetry is itself worth noticing: the largest stablecoin on earth is issued by a company you cannot examine the way you can examine a public one.
What this does not tell you
It does not tell you the freezes were wrong. About $2.4 billion was stopped from reaching a thief within minutes, which is faster than any bank, court or regulator on the planet could have managed. If the money ends up back with the people it was taken from, the mechanism will have worked exactly as intended and the victims will be glad it exists.
It does not tell you your own holdings are at risk. The overwhelming majority of stablecoin balances will never be touched. Four hundred addresses a month is a very large number in absolute terms and a vanishingly small one against the millions of addresses holding these tokens.
It does not tell you how the Binance breach happened. The company has revised its own explanation repeatedly in a single day. Anything definitive you read right now is a guess wearing a confident tone.
It does not tell you who did it. Three forensic firms point the same direction. No government has said so. Those are different categories of claim and collapsing them is how people end up certain about things that later turn out to be wrong.
It does not tell you Binance is in financial trouble. It says it has set aside more than the full amount. That is a claim, not yet a verified fact, and the company has promised a reserves report. Read that when it arrives rather than the promise of it.
And it does not tell you whether this capability is good or bad. That is the actual question and it does not have a technical answer. A system where a private company can immobilize your money without a hearing is either an essential safeguard against theft or an unaccountable power, and which one you call it depends on whether you are the victim or the person on the list. Thursday showed both faces in the same evening.
What it does tell you is something concrete about what you own. Two tokens can both read "one dollar" on the screen, be worth the same, and trade the same, while one of them is a bearer asset nobody can reach and the other is a claim on a company with a documented ability to switch it off. That difference does not appear in the price. It appears only in the mechanics.
Which is the general lesson, and it is why we show the workings rather than a conclusion. A number tells you what something is worth right now. It tells you nothing about what the thing actually is, who controls it, or what has to stay true for the number to keep meaning what it says. Techdamentals runs four separate valuation methods and displays the full range, because one figure tells you where somebody landed and nothing about what it rests on.