Skip to content
techworthit
techworthit

One question, one number. TechWorthIt reads the world's tech reviews and reporting, then tells you whether it's worth your money, with every source linked.

How we scoreAboutContactPrivacyTermsRSS
© 2026 TechWorthIt · We may earn a commission from links. It never changes a verdict.
LatestReviewsDealsSearchSaved 0
techworthit
01 Reviews02 Explainers03 News
SectionExplainers / Business
AuthorTechWorthIt Desk
PublishedOct 30, 2026 · 3 min

Why can some stolen crypto be frozen and the rest cannot?

The Binance theft shows how stablecoins, Bitcoin and Ether differ in who controls them, and why that decides how much of a hack can be undone.

A sturdy padlock clamped onto one coin while several other blank coins roll away across a flat surface.
Illustration
On this page
  1. What does freezing actually mean?
  2. Why can stablecoins be frozen?
  3. Why can Bitcoin and Ether not be frozen?
  4. What is a hot wallet, and why was it the target?
  5. What does it mean for users?
0% read
On this page · 5 sections ▾
  1. What does freezing actually mean?
  2. Why can stablecoins be frozen?
  3. Why can Bitcoin and Ether not be frozen?
  4. What is a hot wallet, and why was it the target?
  5. What does it mean for users?
TL;DR
Stablecoins like USDT and USDC are issued by companies that can blacklist a wallet, so stolen tokens can be locked in place. Bitcoin and Ether have no issuer, so they can only be stopped when the thief tries to cash out at an exchange or other service.

Stolen crypto can be frozen only when a company or group controls the token's rules. Stablecoin issuers such as Tether and Circle can block specific wallets, which locks the tokens in place. Bitcoin and Ether have no such controller, so once they leave a wallet, nobody can stop them from moving.

That difference explains the shape of the Binance theft. As The Next Web reported, about $3 billion was frozen on-chain, while the attacker still held more than 420,000 ETH and 18,270 BTC that no issuer can freeze.

What does freezing actually mean?

Freezing is not recovery. As Tom's Hardware explained, issuers add the thief's wallet to a blacklist in their smart contracts. The tokens stay where they are, but the holder cannot move or exchange them.

Returning the money to its owners is a separate step. Tom's Hardware notes that this usually requires proof of ownership and often long court proceedings.

Why can stablecoins be frozen?

A stablecoin is a token pegged to a currency, such as the dollar. A single company issues it and keeps the code that governs it. That code can include a blacklist function, which the issuer can use on request from investigators or on its own judgment.

In this case, TRM Labs said Tether froze 971.1 million USDT at 21:01 UTC and Circle froze 823 million USDC three minutes later. Ripple, World Liberty Financial and the Arbitrum network's Security Council also froze funds. Speed matters here: the attacker sold about 325 million USDT for ETH at a discount of more than 10% before the freezes spread, according to TRM.

Why can Bitcoin and Ether not be frozen?

Bitcoin and Ether run on networks with no central owner. No company holds a switch to block an address, and transactions are accepted by the network according to its rules. That design is a feature for ordinary users, because no one can lock their savings. It also protects thieves.

Elliptic's Tom Robinson told Wired that the remaining $3.3 billion is mostly Bitcoin, Ether and XRP, which no one can freeze. In his words, it can only be stopped when it reaches an exchange or other service. He does not expect the frozen share to rise much further.

Keep reading

News / Enterprise2d

Coinbase says analytics vendor Amplitude exposed customer data

The exchange denies a breach of its own systems and says customer funds are safe, as other Asian exchanges and brokers also report data security incidents.

A cracked glass jar leaking small coins and fine particles onto a shelf next to an intact closed padlock, symbolising exposed customer data without a breach of the main vault.
News / AI7d

1Password lets AI agents sign in to sites without seeing your passwords

1Password for Agents is live for Individual and Family accounts, but only Muse and Grok Bot work at launch, and outlets differ on what is available and when.

A robotic hand turning a key in a round vault door that is slightly open, with its contents kept hidden.

Some of the stolen value could also be turned into assets that are harder to trace or lock. Inc42 reported that experts, citing on-chain data, said the attacker deposited assets on the lending platform Aave and borrowed Ether against them. Aave then suspended new deposits and borrowing on its V3 and V4 markets.

What is a hot wallet, and why was it the target?

A hot wallet is a crypto wallet kept online so an exchange can pay out customer withdrawals quickly. That convenience makes it more exposed than offline storage, often called cold storage. TRM said the attacker drained Binance hot wallets across at least ten blockchains in about 20 minutes.

On Ethereum, TRM said the attacker used a feature called EIP-7702 to hand control of a hot wallet to its own code. Binance has said it found no evidence of a wallet private key leak. It has said its investigation found multiple points of breach, with a compromised laptop as a possible entry point, and it has promised a technical post-mortem.

What does it mean for users?

Binance says it will cover all losses from its SAFU reserve and company funds, and that user funds are safe. Tom's Hardware put the SAFU fund at 15,000 BTC, or about $1.17 billion at the quoted price, well below the theft total.

The broader lesson is about where trust sits. Tokens with an issuer carry a layer of recourse, while fully decentralized assets carry none. Exchanges concentrate large pools of both in online wallets, so a failure in their internal systems can expose everyone's holdings at once.

Binance also warned of impersonation scams. Tom's Hardware advised extra caution with any offer of compensation or withdrawal restoration, and said to use only official websites or apps.

The news behind this
Binance hit by record $6.3 billion hack, withdrawals paused →

Sources

  • Inc42Binance Hit By Record $6.3 Bn Crypto Breach, Suspends Withdrawals↗
  • EngadgetBinance hacked for an estimated $6.3 billion in record crypto theft↗
  • The Next WebBinance says its $6.3bn hack involved more than a compromised laptop↗
  • Tom's HardwareSuspected North Korean hackers steal $5.6 billion in crypto in record-breaking cryptocurrency heist, Binance withdrawals frozen↗
  • WiredThe $6.3 Billion Binance Hack Was Pulled Off in Just 20 Minutes↗

HOW THIS WAS MADE · Written by the TechWorthIt Desk with AI assistance from 5 published sources, linked above. Facts are cross-checked against those sources before publishing; we never claim testing we didn't do. Last updated Oct 30, 2026. Spotted an error? Tell us.

News / Enterprise7d

US banks move to block third-party AI agents from customer accounts

Morgan Stanley, JPMorgan, Bank of America and others are restricting agents that log in with customer credentials, citing weak visibility, policy conflicts and unclear liability.

A small robot holding a key is stopped by a lowered barrier in front of a massive bank vault door.
News / Dev7d

PHP2Shell flaws draw millions of exploit attempts as sites go offline to patch

Two critical PHP bugs rated 9.2 out of 10 were probed days before disclosure, according to Amazon, while researchers say successful real-world attacks remain limited.

A rack-mounted server with an open drive bay is struck by jagged bolts, with an unlatched padlock and a wrench beside it.