When Is a Hack a Defense? Custodial Liability, Issuer Freezes and the Public Loss after the Binance Theft of 29 October 2026 (OpenAlex (recherche mondiale))

Summary

• On 29 October 2026, about $6.36 billion was taken from Binance's hot wallets across ten blockchains.p.2
• Circle's single freeze caught 100 percent of the 823 million USDC in the main attacker wallet.p.2
• A total of 700 million USDT left the attacker's main receiving wallet within nine minutes before any freeze took effect.p.2
• A third relay wallet deposited 60 million USDT into Aave V3 to borrow 19,762 WETH less than three minutes before being blacklisted.p.2
• Binance reserved $6.34 billion of company funds to replace user losses and covered about 95 percent by 2 November.p.7
• Elliptic verified about $2.84 billion frozen following the incident, 94 percent of which was stablecoins.p.7

Key insights

1. Issuer freeze switches were the only risk controls that operated successfully inside the first hour of the theft.p.11
2. Stablecoin issuer freezes operate at the address level and cannot reach tokens once deposited into shared protocol contracts like Aave.p.11
3. The FBI attributed the Binance theft to North Korean cyber unit TraderTraitor and released an alert identifying 628 cryptocurrency addresses.p.19
4. Under Uniform Commercial Code Article 4A, banks bear unauthorized transfer losses unless they prove compliance with commercially reasonable security procedures.p.13