The Binance hack and its billions in frozen crypto assets expose the uncomfortable truth about digital ownership: your money may be on a blockchain, but someone else can still control it.

A Crypto Exchange Can Freeze Billions After a Hack. Who Actually Controls the Money?

Finance Crypto by Léa Valmont

On October 29, billions of dollars in cryptocurrency began moving out of Binance-controlled wallets without authorization. By the following morning, the world’s largest crypto exchange was describing a security incident with an estimated impact of $6.3 billion, while stablecoin issuers and blockchain partners were scrambling to prevent the attackers from moving some of the assets.

Binance says approximately $3 billion has been frozen. It has also promised to cover all losses using its Secure Asset Fund for Users (SAFU) and company resources. The exchange temporarily suspended withdrawals while investigating the breach, leaving customers unable to move their own funds during the security checks.

The incident raises an uncomfortable question for an industry built around the promise of financial independence: if a cryptocurrency exchange can prevent customers from withdrawing their money, and private companies can freeze billions in tokens after a hack, who actually controls those assets?

The answer depends on where the cryptocurrency is held, who possesses the private keys, which blockchain is involved and whether the asset itself contains administrative controls.

Bitcoin held in a self-custodial wallet operates very differently from Bitcoin credited to an exchange account. A USDC balance can be subject to restrictions that do not exist in Bitcoin’s base protocol. And freezing stolen funds is not the same as recovering them or making customers financially whole.

The Binance incident brings all these distinctions into focus at once. It also demonstrates why the security of a blockchain and the security of a company operating on that blockchain are two very different things.

Table of Contents

What happened in the $6.3 billion Binance security incident?

Binance confirmed a major security incident on October 30, 2026, after suspicious withdrawals from wallets controlled by the exchange triggered an industry-wide effort to trace and restrict affected assets.

According to the company’s official security announcement, the estimated impact is approximately $6.3 billion. Binance says it has worked with blockchain partners to freeze around $3 billion of affected assets.

Those figures are preliminary. The company has not yet published its complete technical investigation, and the precise amount ultimately lost, immobilized or recoverable remains subject to reconciliation.

Binance’s initial findings point to a compromised laptop belonging to a DevOps engineer. The attacker may have used that access to enter a service container and submit unauthorized withdrawal transactions.

That detail is particularly important.

Binance says it has found no evidence that wallet private keys were leaked. In other words, the preliminary account does not describe someone simply stealing a secret key and using it to empty a wallet.

Instead, the suspected attacker appears to have compromised part of the infrastructure responsible for processing authorized withdrawals.

A system can produce valid blockchain transactions while acting on fraudulent instructions. The blockchain may correctly verify the cryptographic signatures even when the organization controlling the wallet never intended to approve those transfers.

That is a fundamentally different security failure from breaking Bitcoin or Ethereum’s underlying cryptography.

Independent blockchain analytics firm Bitquery has published an investigation identifying approximately $6.3 billion in transfers from 17 Binance hot wallets across nine blockchain networks between October 29 and 30.

Its analysis independently identifies around $2.7 billion in frozen assets, somewhat below Binance’s approximately $3 billion figure. The difference should not automatically be treated as evidence that either figure is false: freezing activity, valuation times and the scope of verified transactions can differ.

Binance has said that the $3 billion figure is its current verified total, while promising a detailed post-mortem once the investigation is complete.

The immediate operational response included suspending deposits and withdrawals, revoking affected authorizations and coordinating with law enforcement, token issuers and blockchain intelligence companies.

In a subsequent update, Binance said deposits were operating normally again, while withdrawals remained suspended during further security work. The exchange indicated that withdrawals were expected to resume within approximately 48 hours, subject to completion of those checks.

This was a security response, but it was also an exercise of centralized control.

Customers who had not been hacked personally could nevertheless find themselves temporarily unable to withdraw their assets.

What do you actually own when your crypto is on an exchange?

The phrase “owning Bitcoin” can describe two technically and legally different situations.

In the first, someone holds Bitcoin in a wallet whose private keys they control. Those keys allow the holder to authorize transactions on the Bitcoin network.

In the second, someone has a Bitcoin balance displayed inside an account on a centralized exchange such as Binance, Coinbase or Kraken.

The interface may look similar. Both can display a balance of 0.5 BTC. But the underlying control is different.

With a self-custodial wallet, the holder controls the cryptographic credentials required to spend the coins. The Bitcoin network does not need permission from an exchange to process a valid transaction.

With a custodial exchange account, the platform generally controls the wallets holding the actual cryptocurrency. Customer balances are represented in its internal accounting systems.

The exchange may pool assets belonging to many customers in shared wallets, using internal records to determine what each account is entitled to receive.

That arrangement makes trading convenient. Customers can exchange assets rapidly, place orders, use fiat payment systems and access services without managing blockchain transactions individually.

But the trade-off is substantial.

A customer with Bitcoin on a centralized exchange usually controls an account, not the private keys that authorize transactions from the exchange’s blockchain wallets.

The customer has contractual and potentially statutory rights against the exchange, but the precise nature of those rights depends on the platform’s terms, the legal entity holding the assets and the applicable jurisdiction.

This distinction becomes critical during a hack, insolvency, regulatory intervention or withdrawal suspension.

A balance displayed on a screen is evidence of what the platform says it owes or holds for the customer. It is not, by itself, proof that the customer can independently transfer the corresponding coins.

How exchanges can freeze customer accounts

The simplest form of cryptocurrency freezing does not involve changing anything on a blockchain.

A centralized exchange can disable withdrawals from an account in its own database.

The customer’s Bitcoin, Ether or stablecoin balance may remain visible, but the exchange refuses to process a withdrawal request.

Technically, this is similar to restricting access to a conventional financial account. The exchange controls the service through which the customer attempts to move the assets.

Reasons for restrictions can include suspected fraud, anti-money-laundering investigations, sanctions compliance, court orders, account security concerns or an emergency affecting the platform itself.

During the Binance incident, the exchange temporarily suspended withdrawals across its platform while investigating unauthorized transactions.

That did not mean Bitcoin’s network had stopped operating. Nor did it mean every customer’s individual wallet had been compromised.

It meant the centralized service responsible for processing those customers’ withdrawal requests was not allowing them to proceed.

The distinction is important because a centralized exchange can impose restrictions on assets whose underlying blockchains have no comparable freezing mechanism.

A company does not need to control the Bitcoin network to prevent a customer from withdrawing Bitcoin held in the company’s custody.

It only needs to control the wallet and the account system through which the customer accesses it.

How billions in stolen crypto can be frozen on-chain

The Binance incident involves another, more technically interesting form of control: the ability of some token issuers to block transfers directly at the smart-contract level.

Stablecoins such as Tether’s USDT and Circle’s USDC are designed to maintain a value close to the US dollar. They are widely used for trading, payments and transferring liquidity between cryptocurrency platforms.

But they are not structurally identical to Bitcoin.

On networks such as Ethereum, USDC and USDT exist as tokens governed by smart contracts. Those contracts define how balances are recorded and transferred.

Depending on the token and network, the contracts can also include administrative functions allowing authorized parties to restrict particular addresses.

Circle explicitly describes this capability in its stablecoin blocklisting documentation.

An address placed on the blocklist can be prevented from sending or receiving the affected token.

This does not require rewriting Ethereum’s transaction history. The original transfer remains recorded on the blockchain.

Instead, the token’s smart contract refuses to process certain subsequent transfers involving the restricted address.

During the Binance incident, Tether and Circle reportedly froze substantial quantities of stablecoins linked to the suspicious withdrawals.

Reuters reported that both issuers participated in the response. Blockchain analytics firm Bitquery subsequently identified approximately 1.76 billion USDT and 823 million USDC immobilized through issuer-level restrictions.

These figures represent an independent on-chain assessment at a particular point in the investigation, not a final accounting of every asset affected.

The distinction between freezing and reversing matters enormously.

A stablecoin issuer may be able to prevent stolen tokens from moving without being able to undo the original theft.

The tokens can remain visible at the compromised address while becoming unusable for ordinary transfers.

Further steps may be required before the rightful owner receives replacement tokens or the frozen value is otherwise recovered. Those steps depend on the issuer’s technical capabilities, applicable legal authority and the circumstances of the incident.

This is one of the central contradictions in the popular image of cryptocurrency as an entirely permissionless financial system.

Some of its most widely used assets depend on identifiable companies that retain powerful administrative controls.

Those controls can protect victims of theft. They can also create censorship, legal and governance risks that users should understand before treating all blockchain assets as equivalent.

Why Bitcoin and Ether are harder to freeze

Bitcoin operates differently from centrally issued stablecoins.

There is no Bitcoin company with an administrative function that can blacklist an address and make its coins unspendable across the entire network.

If someone controls the private keys associated with spendable Bitcoin, they can generally construct and broadcast a valid transaction, subject to the network’s consensus rules.

An exchange can refuse to accept deposits from a suspicious address. A payment processor can reject a transaction. Authorities can seize a device or compel a custodian to surrender keys.

But none of those actions is equivalent to an issuer freezing native Bitcoin at the protocol level.

Native Ether on Ethereum presents a similar distinction. Its transfers are governed by Ethereum’s consensus and execution rules rather than an ordinary token issuer’s blacklist.

That does not mean stolen BTC or ETH is impossible to recover.

Investigators can trace transactions, identify connections to centralized services and ask those services to block deposits or withdrawals. Law enforcement can obtain court orders and, in some cases, seize assets after gaining control of relevant accounts or keys.

The process is different from freezing USDC through its issuer-controlled contract.

There are also exceptions involving particular blockchain environments. Bridges, wrapped tokens, layer-2 networks and other systems may have administrative or emergency mechanisms that do not exist for native assets on the underlying base chain.

During the Binance investigation, Bitquery reported that Arbitrum’s Security Council helped immobilize certain affected assets through a network-specific intervention.

That should not be confused with a universal ability to freeze Ether everywhere.

The practical lesson is that cryptocurrency control depends on the entire technical arrangement, not merely the name of the asset.

BTC on Bitcoin, wrapped BTC issued by a custodian and a Bitcoin balance inside an exchange account can carry very different control and counterparty risks.

Freezing stolen crypto is not the same as recovering it

The difference between immobilizing an asset and returning it to its owner is easy to overlook when headlines announce that billions have been frozen.

Imagine an attacker steals $100 million in stablecoins.

The issuer identifies the receiving address and blocks the tokens before the attacker can transfer them elsewhere.

The stolen tokens may now be economically unusable to the attacker. That is a successful containment measure.

But the victim does not automatically have $100 million back in its account.

The original transfer may still be recorded on-chain, and the tokens may remain at the restricted address.

Recovery could require additional issuer action, a legal process, the cooperation of custodians or some combination of these measures.

The situation becomes more complicated when attackers move funds before restrictions are applied.

Stablecoins can be exchanged for other cryptocurrencies through decentralized exchanges, transferred across networks or divided among numerous wallets.

If the attacker converts USDT into native Ether before the relevant USDT address is blocked, freezing the original stablecoin contract may no longer immobilize the value that has already moved.

Investigators can continue tracing those proceeds, but the available enforcement mechanisms change.

This is why speed matters.

Token issuers, exchanges, blockchain analytics companies and law enforcement agencies may coordinate during the first hours of an attack to identify addresses before funds can be dispersed.

That cooperation can prevent further movement. It cannot guarantee full recovery.

It also introduces questions about the accuracy and accountability of freezing decisions.

A mistaken attribution could affect an innocent address. Funds may pass through intermediaries, including liquidity pools and services used by legitimate customers. Determining which assets should be restricted can become legally and technically difficult.

The more aggressively an ecosystem responds to theft, the more important its procedures for verification, appeal and eventual release become.

Who pays when an exchange promises to reimburse users?

Binance says it will cover losses arising from the incident through its SAFU fund and company resources.

SAFU, short for Secure Asset Fund for Users, is a reserve mechanism established by Binance to help protect customers in exceptional circumstances.

The announcement is significant because freezing $3 billion does not automatically resolve a security incident estimated at $6.3 billion.

Even if every frozen asset ultimately becomes recoverable, there may still be a substantial shortfall. The final figure depends on which assets were transferred, what can be recovered, changes in market prices and how Binance accounts for the incident.

A reimbursement promise is also different from evidence that all claims have already been paid.

Binance must determine the losses attributable to the incident, reconcile affected balances and ensure that its resources are sufficient to meet the commitments it has made.

If an exchange replaces missing customer assets using its own funds, the economic cost falls on the company and ultimately on the stakeholders bearing its financial risks.

If a dedicated reserve fund is used, the fund’s available assets are reduced.

If recovered assets subsequently become available, the exchange may be able to replenish some of those resources, depending on the legal and operational arrangements.

But reimbursement is not guaranteed by the mere existence of a blockchain or a customer account balance.

It depends on the exchange’s financial capacity, applicable legal obligations and ability to execute the promised compensation.

This is one reason proof-of-reserves disclosures matter, although their limitations must be understood.

A cryptographic proof of reserves can help demonstrate that an exchange controls certain assets at a particular point in time. Depending on its design, it may also allow customers to verify that their balances are included in a disclosed set of liabilities.

But a snapshot of wallet assets is not automatically a comprehensive audit of the company.

It may not establish all liabilities, off-balance-sheet obligations, related-party exposures or the legal status of customer assets.

Binance has promised an updated proof of reserves after its remediation work.

That information could help users evaluate the platform’s position, but it will need to be interpreted alongside a fuller account of the breach and any resulting financial obligations.

What Mt. Gox taught the industry about custody

The history of cryptocurrency offers a particularly relevant precedent.

Mt. Gox was once the dominant Bitcoin exchange. In 2014, it collapsed after reporting the disappearance of hundreds of thousands of bitcoins.

The precise circumstances differed substantially from the current Binance incident, and the two cases should not be treated as technically equivalent.

But Mt. Gox demonstrated what happens when customers depend on a centralized company to safeguard assets that they cannot independently access.

When the exchange failed, users did not simply retrieve their Bitcoin from the blockchain.

They became involved in a lengthy legal process concerning the exchange’s assets, liabilities and obligations to creditors.

Some Bitcoin was subsequently recovered, and repayment proceedings have continued over many years.

The broader lesson is about custody rather than a particular hacking technique.

A blockchain can continue operating normally while a company that holds customer assets becomes unable to honor withdrawals.

The customer’s rights then depend on the company’s financial condition, the legal treatment of the assets and the outcome of recovery or insolvency proceedings.

In that sense, Mt. Gox exposed a problem that remains relevant even as modern exchanges adopt more sophisticated security systems.

The risk is not simply that someone might steal private keys. It is that customers have delegated control of their assets to an organization whose operational and financial resilience they cannot fully verify.

Is self-custody actually safer?

The standard cryptocurrency response to exchange failures is familiar: not your keys, not your coins.

The phrase captures a genuine technical distinction. Holding your own private keys removes the exchange’s ability to approve or deny ordinary transactions from your wallet.

But it does not eliminate risk. It changes who is responsible for managing it.

With self-custody, users must protect their recovery phrases, signing devices and wallet software.

A phishing attack can trick someone into signing a malicious transaction. Malware can compromise a computer. A lost recovery phrase can make assets permanently inaccessible. A mistaken transfer to the wrong address may be irreversible.

Smart-contract interactions create additional risks. A user can retain control of their wallet while granting a malicious application permission to transfer tokens.

Hardware wallets and careful transaction verification can reduce some of these risks, but they do not make mistakes impossible.

Custodial exchanges, meanwhile, can provide useful protections.

They may offer account recovery, security monitoring, withdrawal controls, customer support and the ability to respond to suspected fraud.

They can also coordinate reimbursements after incidents, as Binance has promised to do.

The price is dependence on the custodian.

A user who stores assets on an exchange relies on its internal controls, financial resources, legal obligations and willingness or ability to process withdrawals.

Neither arrangement is universally superior.

For someone making frequent trades, a reputable custodial platform may provide meaningful convenience and operational safeguards.

For someone prioritizing independent control over long-term holdings, self-custody may better match their objectives, provided they can manage the associated security responsibilities.

The important decision is not whether cryptocurrency should be centralized or decentralized in the abstract.

It is which risks the user is prepared and equipped to manage personally, and which risks they are willing to delegate.

The real meaning of ownership in crypto

The Binance security incident has exposed several layers of control that are often compressed into the single word “crypto.”

There is control over an exchange account, which can be restricted by the platform.

There is control over private keys, which determines who can authorize transactions from a self-custodial wallet.

There is control embedded in certain token contracts, which can allow issuers to block transfers.

And there is the legal authority exercised by courts, regulators and law enforcement agencies over companies and individuals operating within their jurisdictions.

These forms of control can overlap.

A user might hold USDC in a self-custodial wallet, retaining the private key while remaining subject to the token issuer’s blocklisting functionality.

Another user might hold Bitcoin on an exchange, owning an account balance while the exchange controls the keys needed to move the actual coins.

Neither situation can be understood simply by saying that the assets exist on a blockchain.

The Binance case also reveals why centralization is not always a straightforward disadvantage.

The same administrative powers that allow an exchange to suspend withdrawals or a stablecoin issuer to freeze tokens can help contain theft and protect customers.

But those powers require trust in the organizations exercising them.

Who decides which assets are suspicious? What evidence is required? What happens when a freeze is mistaken? How long can legitimate users be denied access? Who is accountable when emergency measures cause additional losses?

Those are governance questions as much as technical ones.

Binance’s investigation remains incomplete. Its $6.3 billion impact estimate and approximately $3 billion frozen figure may be refined as investigators reconcile transactions and determine which assets can actually be recovered.

Its reimbursement promise also needs to be judged against the eventual restoration of customer access and the company’s demonstrated ability to absorb the losses.

For now, the most important conclusion is not that cryptocurrency has failed to deliver decentralization, nor that centralized intervention has saved it.

It is that different parts of the crypto economy offer different forms of ownership, protection and control.

A blockchain can give users the ability to move money without asking permission. A custodial exchange can take that ability away in an instant. And a stablecoin issuer may retain the power to immobilize tokens even when the holder controls the wallet.

Understanding those distinctions is more useful than any slogan about financial freedom.

The Binance hack raises a terrifying question: when billions in crypto assets are stolen, who really has the power to freeze the money before it disappears?

The biggest threat revealed by the reported Binance hack isn’t just the theft itself — it’s the realization that your crypto can be stolen, frozen, or locked away by someone else.

 

Crypto Custody and Frozen Assets: Key Questions

Was Binance hacked for $6.3 billion in October 2026?

Binance confirmed a security incident with an estimated impact of approximately $6.3 billion. Its preliminary investigation points to unauthorized withdrawals enabled by compromised internal infrastructure. The final loss and recovery figures remain subject to investigation.

How much cryptocurrency has been frozen after the Binance hack?

Binance reported approximately $3 billion in affected assets frozen through cooperation with blockchain partners. Independent on-chain analysis by Bitquery identified approximately $2.7 billion at the time of its investigation. The amounts may change as tracing and freezing efforts continue.

Can Binance freeze my Bitcoin?

Binance can suspend withdrawals or restrict accounts holding Bitcoin in its custody. It cannot unilaterally freeze native Bitcoin held in an independent wallet merely by changing its own account records.

Can USDT or USDC be frozen in a private wallet?

Yes. On supported networks, Tether and Circle have administrative mechanisms that can restrict transfers involving particular token addresses. Holding the private key does not necessarily override those token-level restrictions.

Can a cryptocurrency transaction be reversed after a hack?

Confirmed blockchain transactions generally cannot simply be reversed by an exchange. Some token issuers can freeze assets or take additional administrative action, while investigators may recover funds through cooperation with custodians and law enforcement.

Does Binance’s reimbursement promise guarantee that every user has already been compensated?

No. Binance has committed to covering losses using SAFU and company resources, but a promise is not evidence that all compensation has been completed. The final financial impact and recovery process remain under investigation.

Is keeping cryptocurrency on an exchange safer than self-custody?

Each approach involves different risks. Exchanges provide convenience and operational support but introduce custodial and counterparty risk. Self-custody offers greater independent control while making the user responsible for securing keys and authorizing transactions.

Is this article financial advice?

No. It explains cryptocurrency custody, security and financial risks for informational purposes and does not constitute personalized financial or investment advice.

Sources