Tether froze more than $1.5 billion in stolen USDT within 30 minutes of Binance's Oct. 29 hack, highlighting stablecoins' ability to disrupt cryptocurrency theft.
Related Asset Tether USDT · Stablecoin
In a Nov. 2 statement, the world's largest stablecoin issuer said its intervention prevented the immobilized funds from being transferred or laundered by attackers linked to North Korea.
The announcement followed an Oct. 31 FBI alert attributing the theft of more than $6 billion from Binance to North Korea's TraderTraitor hacking operation, which US authorities have linked to efforts to finance the country's weapons programs.
Related Company Binance Global crypto exchange
Tether CEO Paolo Ardoino said the incident demonstrated why USDT was an unattractive vehicle for criminals, arguing that the company's ability to rapidly block suspicious addresses made it difficult for attackers to retain access to stolen assets.
Related Person Paolo Ardoino CEO · Tether Limited
The intervention also prompted a broader debate about stablecoins' effectiveness in combating financial crime.
Rayne Steinberg, co-founder of digital asset investment firm Arca, contrasted Tether's response with traditional banks' histories of processing illicit transactions, arguing that financial institutions have often identified money laundering only after funds had already moved through their systems.
Steinberg pointed to major banking scandals involving sanctions evasion and criminal proceeds, questioning the criticism frequently directed at stablecoins over their potential use in illicit finance.
He said:
“Turns out a ledger you can actually see beats a duffel bag you can't.”
Tether cited its broader enforcement record to support that argument. The company said it has frozen more than $7 billion in USDT across secondary-market addresses, including the latest Binance intervention, and helped return approximately $1.2 billion to rightful owners and law enforcement through token reissuance.
It also reported working with more than 360 law enforcement agencies across 73 countries to investigate financial crime and restrict suspicious transactions.
Hundreds of millions escaped Tether's freeze
Despite the rapid intervention, blockchain investigators found that attackers managed to move substantial amounts of stolen USDT before Tether could restrict their wallets.
According to Bitquery's investigation, approximately $729 million in stolen USDT escaped the freezes, with much of the money converted into Ethereum and TRON tokens through decentralized trading platforms.
Related Asset Ethereum ETH · $2,263.16 24-hour change: down 0.92%
The firm identified 11 attacker-controlled wallets frozen by Tether across Ethereum and TRON, six of which had already been emptied when restrictions took effect.
One attacker-controlled wallet also deposited $60 million in USDT into decentralized lending protocol Aave shortly before being frozen, allowing the hackers to borrow approximately $45 million in ETH against those assets.
Related Asset TRON TRX · $0.32 24-hour change: up 1.84%
Because the USDT had entered Aave's lending pool, freezing the attacker's wallet did not immobilize the collateral.
Bitquery estimated that approximately $1.76 billion in stolen USDT was ultimately frozen, representing about 71% of the amount taken. Across stablecoin issuers and other emergency interventions, roughly $2.7 billion of the stolen assets was immobilized or secured.
The findings illustrate both the effectiveness and limitations of issuer-controlled freezes. Tether can restrict transfers from identified wallets, but assets already exchanged into cryptocurrencies such as ETH remain outside its direct control.
The fate of the immobilized funds also remains unresolved. Although Tether has previously helped transfer frozen assets to law enforcement or rightful owners through reissuance, its latest disclosure did not identify a receiving party, legal authorization, or recovery timeline for the Binance-linked USDT.
Meanwhile, Bitquery estimated that the attackers still controlled approximately $3 billion in cryptocurrency as of Nov. 2, predominantly Bitcoin and Ethereum, with US authorities urging exchanges, blockchain operators and other service providers to block transactions associated with identified North Korean wallets.