44% of Binance's $6.43B Haul Frozen as Arbitrum Council Moves Hackers' Ether

The Binance hackers pulled off a $6.43 billion heist on Oct. 29. Less than an hour later, big chunks of it stopped moving. Tether and Circle, the outfits behind USDT and USDC, froze most of the stolen dollar tokens almost immediately, and by that evening Arbitrum's Security Council had yanked the hackers' ether and ARB out of their wallet without so much as a private key, according to blockchain analytics firm Elliptic.

Elliptic puts the frozen or seized total at roughly 44% of the haul, a giant leap from the measly 3% recovered after the Bybit theft last year. The mechanics are simple enough: Tether's contract carries a blacklist only the issuer controls, and it can also destroy a blacklisted balance and reissue the tokens — a route Tether says has returned about $1.2 billion from past thefts. Circle's contract has a blacklist too, but no destroy-and-reissue button. Tether froze the hackers' USDT 37 minutes after it hit their main wallet, and Circle locked down all $823 million in stolen USDC minutes later. Both balances are still sitting there, frozen solid.

Arbitrum doesn't have a freeze button. It has something bigger. A 12-person Security Council can make any upgrade on the spot during a security emergency, and nine signatures were enough to swap out the software relaying transactions and send two transactions in the hackers' name — moving 8,425 ETH and 74.6 million ARB into a holding address. The council did the same thing to the KelpDAO exploiter in April, though that ether stayed locked until June 15, partly because a legal fight over court judgments against North Korea had to clear before token holders voted the funds to Aave.

Not everything was stoppable. None of the 18,270 stolen bitcoin has been frozen, and neither has the stolen ether sitting on Ethereum itself. Those coins answer to whoever holds the key, full stop. The networks where someone else holds a switch are a different story, and the club is growing — Robinhood Chain, built on Arbitrum's tech stack in July and now holding about $2.24 billion, hands a freeze power to a Robinhood wallet needing seven of eight signatures with no waiting period, per L2BEAT. Across the 83 layer-2 networks L2BEAT tracks, 79 give users no window to pull funds before an upgrade lands.

Circle says it freezes funds only when legally compelled through lawful process, and in May it carved out an exception for urgent law enforcement requests made ahead of a court order, American Banker reported. That's the tension in a nutshell: the same switches that let issuers and councils claw back stolen coins sit over everyone else's too. Crypto's founding pitch was that only the key holder moves the coins. The Binance theft just showed how often that pitch comes with an asterisk.