Binance Lost $6.4 Billion in 20 Minutes. Only the Coins With an Off Switch Stopped Moving.

At 20:05 UTC on Thursday, five Binance wallets on the XRP Ledger sent 233 million XRP to a single address. Over the next half hour, hot wallets on Solana, Bitcoin, Tron, Ethereum, Arbitrum and five other networks emptied out. By the time the sweeps stopped, Elliptic counted $6.43 billion gone, more than four times the Bybit theft of 2025 and, by its reckoning, almost certainly the largest theft of any kind ever recorded. TRM Labs put the figure at $6.36 billion, most of it moved in about 20 minutes, and attributed the attack "with high confidence" to TraderTraitor, the North Korean unit behind Bybit.

The headline number is staggering. The second number is the one that matters. A day later, Binance said partners had frozen roughly $3 billion of the stolen assets. Elliptic has verified $2.84 billion of that, and found that 94% of it is stablecoins. Nothing on Bitcoin, the XRP Ledger, Solana or NEAR has been frozen, because those assets have no issuer who can say no.

Half the loot is stuck. The half that isn't is the half crypto was built to make unstoppable.

The biggest heist in crypto history was capped by the feature crypto's purists most want to delete.

Every post-mortem will focus on how the attacker got in, and it should. But the recovery story is the one that will shape what the next attacker does, and what regulators write next.

The freeze worked because the attacker was slow, not because the system was fast.

The mechanics are now well documented. According to Blockaid's analysis reported by crypto.news, a single Ethereum transaction at 20:20 UTC carried 50 EIP-7702 authorizations for the Binance 14 hot wallet, one for each of 50 consecutive nonces. Only one needed to match. It did, and the wallet's behavior was handed to a sweeper contract that drained 167,464 ETH and more than 1.6 billion USDT about three and a half minutes later. Elliptic found the delegation stayed live long enough to pull 823 million USDC from a second Binance wallet and sweep fresh deposits four more times, the last at 23:56 UTC.

That left the attacker holding an enormous pile of dollar tokens in one wallet. Tether froze that main Ethereum wallet 37 minutes after the big transfer, locking 1.18 billion USDT, and Circle froze the 823 million USDC in the same address three minutes later. Ripple, World Liberty Financial, Paxos and First Digital froze their own tokens. TRM logged Tether at about $1.77 billion and Circle at about $825 million by half past midnight.

Thirty-seven minutes is a long time in this business. The attacker used it to dump about $786 million of stablecoins into ETH and TRX, and Elliptic estimates those swaps cost 12% to 26% in slippage. North Korea's operators paid a steep premium to get out of anything with a blacklist function. That premium is the clearest price signal the market has ever produced for what freezability is worth to a thief.

Compare it with last month. When Bitget lost an estimated $387 million in September, the attacker converted stablecoins to ETH within minutes. Circle and Tether froze what was left, which came to about $318,000. Same issuers, same freeze buttons, a recovery rate under 0.1%. The difference was not the issuers' reflexes. It was the attacker's.

Washington already wrote the off switch into law, and it is about to make it mandatory at the exchange door.

The GENIUS Act allows a permitted issuer to issue payment stablecoins only if it has the technological capability to comply with lawful orders to seize, freeze or burn tokens. The Senate Banking Committee's own fact sheet framed that requirement as a national security provision, reaching foreign issuers whose tokens trade in US secondary markets.

Treasury's proposed rule under Section 3 of the act, published in August with comments that closed on October 19, would go further: from July 2028, exchanges could offer US users only stablecoins from permitted issuers, which in practice means tokens whose issuers can block transfers on a lawful order. Thursday's hack is the best case for that rule that anyone could have scripted. Roughly $2.67 billion in frozen stablecoins sits on one side of the ledger, and $3.28 billion in unfreezable ETH, BTC, XRP and TRX on the other.

Expect that comparison to show up in the final rule's preamble.

The strongest objection is real, and it still misses where the risk lives.

Concede the industry's point. A freeze key is a censorship key. The same button that stopped North Korea can stop anyone an issuer, or a government, decides to stop, and the two biggest issuers don't even agree on when to press it. New York Attorney General Letitia James wrote that Circle will freeze only after a signed judicial order or warrant, while Tether acts on law enforcement requests. And the most dramatic intervention of the night didn't involve a stablecoin at all: the Arbitrum Security Council moved 74.6 million ARB and 8,425 ETH out of an attacker address into a restricted wallet that can only release them through further council action or a DAO vote. A layer-2 chain demonstrated it can move anyone's ETH if enough signers agree. That should unsettle people who thought "decentralized" meant something more specific.

The purists are also right that freezes are not security. They are cleanup. Bitget proved that a disciplined attacker leaves the freeze buttons with nothing to press.

But none of that rescues the idea that crypto's security model works without chokepoints. The Binance breach did not happen in a smart contract or a protocol. It happened, by Binance's account, on a compromised engineer's laptop that gave the attacker access to a service container able to submit withdrawals, with "additional points of breach" still unnamed. No private key leaked. The attacker simply got Binance's own systems to sign. One security researcher quoted by CBS questioned why a single signature could apparently grant persistent, full access to a hot wallet. That question has no decentralized answer. The weak point was an operations team, and the only backstop that held was another operations team at Tether.

The real cost lands on the coins nobody can freeze.

Binance says it has reserved more than $6.34 billion of company funds to cover the losses, about $5 billion of it in the same tokens that were stolen, and users are expected to be made whole. That is the good news, and it will dominate the next week of coverage.

The quieter consequence is what this does to how exchanges, treasuries and market makers price native assets against stablecoins. A dollar of USDT in a hot wallet now carries an implicit recovery option that a dollar of ETH or BTC does not. Elliptic tallied 519,104 ETH and 18,270 BTC beyond any issuer's reach, already being split across dozens of addresses. The FBI named North Korea within days of Bybit, and it may do so again here. Attribution doesn't freeze anything.

For anyone running a treasury, the lesson is uncomfortable and practical. Native assets in hot wallets are the uninsurable tail. Stablecoins are, for better or worse, the part of the balance sheet with a second line of defense attached.

The attacker learned the same lesson, at a cost of somewhere between 12% and 26%. Next time the stablecoins will be gone in 37 seconds, not 37 minutes, and the only thing left to freeze will be the coins that can't be frozen.