Original | Odaily Planet Daily (@OdailyChina)

Author | Wenser (@wenser 2010)

One week later, the impact of the "Binance $6.3 billion asset theft case" has gradually been minimized in the collaborative processing within the cryptocurrency industry, preventing the recurrence of tragedies like the "Mentougou theft case" or the "FTX collapse." This can be attributed to both the significant development and enhanced resilience of the cryptocurrency industry compared to the past, as well as the various organizations that assisted Binance in tracking the hacker attacks, freezing the stolen assets, aiding in security offense and defense, and avoiding further financial losses. In this "largest theft in cryptocurrency history," stablecoin issuers, law enforcement agencies, on-chain analysis companies, L2 networks, and DeFi protocols all took action to prevent further loss. To some extent, these organizations deserve to be remembered by the cryptocurrency industry.

In light of this, Odaily Planet Daily has compiled a list of organizations that contributed the most to the Binance theft case based on public information, for reference by leading CEXs and people in the cryptocurrency industry.

First Place: Stablecoin Issuer Tether, Assisted in Freezing Over $1.567 Billion

After the theft of Binance assets occurred, the stablecoin giant Tether quickly followed up on freezing the stolen assets.

Tether CEO Paolo Ardoino stated that they cooperated to freeze over 1.567 billion USDT related to the potential Binance theft. Several media outlets reported that Tether froze about 1.18 billion USDT shortly after the stolen USDT reached the attacker's main Ethereum wallet, and then froze four additional attacker addresses within 17 minutes.

As the largest stablecoin issuer, Tether has been particularly proactive in cooperating with the handling of the stolen assets, and it is the party that froze the most significant amount of funds in this security incident, effectively cutting off a substantial portion of the hacker's liquid funds and helping to contain the losses from the stolen assets.

Of course, it is important to note that Tether’s freezing merely prevents the transfer of USDT and does not mean that Binance has recovered the corresponding funds; the subsequent handling still relies on the gradual advancement of various processes.

Second Place: Stablecoin Issuer Circle, Assisted in Freezing About $823 Million

Like Tether, Circle also performed admirably in this incident. Circle CEO Jeremy Allaire publicly stated that they had frozen over $800 million USDC related to the Binance theft and coordinated with law enforcement. In terms of processing time, Circle was only 3 minutes slower than Tether, which is considered rapid compared to previous fund freezing operations.

As a result, Tether and Circle together contributed over $2.3 billion of the $3 billion frozen assets, with stablecoins such as USDT and USDC accounting for about 94% of the stolen assets in stablecoins, almost all on the Ethereum and Tron chains.

Third Place: Law Enforcement Agency FBI, Officially Attributing and Releasing Over 600 Involved Addresses

In this theft incident, it is relatively rare for a law enforcement agency to join the handling team along with cryptocurrency industry organizations. Notably, the FBI stepped in.

On October 31, the FBI’s Cyber Crime Division issued a notice stating that they attributed the theft of over $6 billion in virtual assets from Binance to a North Korean hacking group, code-named TraderTraitor.

According to information publicly released by the FBI, the attacker’s involved addresses include approximately over 600 Ethereum addresses, nearly 20 Bitcoin addresses, and one Solana address. Subsequently, the FBI, the Secret Service, and IRS-CI jointly called on THORChain nodes, RPC nodes, instant exchange services, DeFi services, on-chain analysis firms, and virtual asset service providers to block transactions related to, or derived from, these addresses.

The Secret Service also stated that within minutes after the incident, they collaborated with industry players to identify and freeze a significant portion of the stolen funds, and worked jointly with the federal prosecutor's office in Washington D.C., the U.S. Attorney’s Office for the Central District of California, and relevant offices of the Department of Justice.

With the FBI's assistance, the handling of the stolen Binance assets has effectively come under the purview of global law enforcement agencies, providing more enforcement layer assurance.

Fourth Place: On-Chain Analysis Companies Elliptic, Chainalysis, TRM Labs, SlowMist, Providing On-Chain Intelligence Tracking

Excluding direct stablecoin issuers that froze assets and the initiating FBI investigation, on-chain analysis firms played a significant role in this security incident, with notable organizations including Elliptic, Chainalysis, TRM Labs, and SlowMist.

Elliptic estimated the theft to be approximately $6.43 billion, verified that about $2.85 billion was frozen or seized, and published a downloadable blacklist of involved addresses, which later expanded to thousands and even tens of thousands of addresses. They also stated that their alerts had prompted part of the stolen funds to be frozen.

Chainalysis mentioned in their blog that investigators proactively shared leads with industry partners to assist in identification and freezing; as of November 3 at approximately 11:30 AM ET, about $2.8 billion had been frozen. They linked Binance's stolen funds with the previous month's Bitget theft, strengthening the attribution to North Korea. CEO Jonathan Levin also reminded that hackers had used thousands of addresses, which could expand to tens of thousands in the coming weeks.

TRM Labs pointed strongly towards TraderTraitor, comparing methods to the 2025 Bybit and the April 2026 KelpDAO cases; CNBC also cited their description of Tornado Cash's small withdrawals, pre-rehearsed events, and single-burst signatures.

SlowMist founder Yu Qian emphasized the attack methods of the Binance hackers, stating that they used the EIP-7702 mechanism to steal tokens from hot wallets en masse and rehearsed for hours before the attack; SlowMist's Chief Information Security Officer 23pds had also previously written to suggest investigating private key leakage and abnormal withdrawal tools, providing numerous reference ideas for the incident investigation despite slight discrepancies with the actual causes of the event.

On-chain analysis firms and security organizations are the backbone in such asset theft events; without these professionals, many details would be difficult for the public to be aware of, especially concerning technical aspects and on-chain traces.

Fifth Place: L2 Networks Arbitrum and Optimism, Together Protecting About $35 Million in Assets

Due to the diverse types of tokens involved in this attack, L2 networks also play a significant role in responding to the stolen assets.

On October 30, the day of the theft, Arbitrum's security committee executed an emergency operation, transferring approximately 8,426 ETH and about 74.56 million ARB from the attacker's address to an intermediate frozen address, totaling approximately $30.5 million. The official emphasized: these funds can only be moved by the security committee or Arbitrum DAO governance votes, and other users and applications were not affected.

Additonally, Optimism had about 44 million OP, around $5 million in assets moved out of the attacker's address by governance as protective funds.

Although the scale of funds is much smaller than the frozen assets of Tether and Circle, this is one of the few actions that genuinely removed assets from the hacker's control, rather than just tagging them. Currently, Binance has submitted a governance proposal to recover this batch of assets, although the process may take several weeks, it has set a precedent for the return of stolen assets.

Sixth Place: Stablecoin Issuer World Liberty Financial, Assisted in Freezing About $29 Million in Assets

Although the WLFI project has a poor reputation in the crypto market, its response in the Binance theft incident was also very swift.

Previously, Binance co-founder and Co-CEO He Yi disclosed that World Liberty Financial (WLFI) had frozen approximately $27 million in USD1 related to the incident, as well as about $2 million worth of WLFI. WLFI co-founder Zach Witkoff publicly confirmed that freezing steps had been taken and stated that they would cooperate with BitGo to handle the stolen WLFI and USD1.

This shows that many stablecoin issuers lent a hand in this attack incident; aside from Tether, Circle, and WLFI, projects like Ripple for its stablecoin RLUSD, Paxos, and First Digital also assisted in freezing their corresponding stablecoins, contributing to the protection of stolen assets.

Seventh Place: DeFi Protocol Aave, Proactive Freezing of Market, Involving Funds of $60 Million

Aave also contributed in its own way during this security incident.

According to on-chain data, the Binance hackers had previously deposited about 60 million USDT into Ethereum Aave V3, borrowing about 19,762 WETH, equivalent to about $44.6 million at the time. Aave subsequently proactively froze hundreds of DAO-operated market reserves in V3 and V4, suspending new deposits and new loans, while allowing withdrawals, repayments, and liquidations to proceed.

Aave founder Stani Kulechov stated that the contract was unaffected, and positions remained over-collateralized.

It is worth mentioning that Aave’s greatest contribution in this incident was not in freezing assets but in preventing the hacker from further leveraging or trading the stolen funds within the protocol; previously borrowed ETH remained under the control of the attacker.

Eighth Place: Crypto Exchanges OKX, Coinbase, Bybit, Assisted in Intercepting Fund Transfers

After the Binance theft incident, many CEXs also expressed support and assistance; OKX CEO Star specifically called for the establishment of CEX industry security standards and coordinated response mechanisms.

Coinbase CEO Brian Armstrong quickly stated that his team was doing its utmost to provide support, including intercepting transfers to the compromised wallet, and has contacted Binance to offer assistance. He stated that the industry should jointly respond to the current situation, openly share useful information, and protect customers; the crypto industry has gone through multiple difficult periods and emerged stronger each time, and this time will be no exception.

Bybit founder and CEO Ben Zhou also publicly stated that there were reports circulating on social media about security incidents on various platforms. Bybit was not affected, the system was functioning normally, and trading and withdrawal functions were still available, ensuring user asset safety. Bybit is willing to provide various support to Binance.

Regarding the recent security incidents involving Bybit, Bitget, and Binance, OKX founder and CEO Star also publicly stated that security should not become an area of competition, but a shared responsibility of the entire cryptocurrency industry. Over the past decade, major exchanges have made significant progress in private key protection, but access control and wallet management systems still pose potential risks. He emphasized that no system is absolutely secure, and any major security vulnerability at an exchange could undermine trust in the entire industry. He called for the major exchanges in the cryptocurrency industry to strengthen collaboration, jointly establish stricter industry security standards and coordinated response mechanisms, including increasing verification and security delays for large withdrawals from unknown addresses and smart contract authorization transactions, as well as implementing key security restrictions at the cryptocurrency signature layer. At the same time, the industry should establish real-time security incident reporting, joint monitoring of suspicious funds, and rapid response mechanisms, and promote collaborative research in areas such as post-quantum cryptography and AI security threat defense. He emphasized that no single company can safeguard the future of the cryptocurrency industry alone.

The Binance Theft Incident Serves as a Warning; The Cryptocurrency Industry Must Remain Vigilant

Finally, the freezing of stolen funds is merely the first half of the Binance theft incident; the real second half of this theft incident will depend on whether the related assets that have not been frozen can be intercepted a second time through OTC channels, on-chain mixing platforms, and exchange exits, and ultimately recovered.

In the face of frequent security incidents, maintaining a secure industry environment is an unshirkable responsibility for many institutions and organizations. STAY SAFU.

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到[email protected]，本平台相关工作人员将会进行核查。