What the Binance Hack Reveals About Issuer Freeze Policies
Predicate Team
•
On October 29th, attackers took roughly $6.3 billion from Binance across ten chains. It is the largest crypto theft on record, attributed by the FBI to the North Korean unit TraderTraitor.
While the size of the hack is noteworthy, so was the incident response time. Issuers froze about $2.8 billion, roughly 44% of the total, with Tether and Circle freezing their assets in record time, respectively at 37 and 40 minutes after the hack. This stands in stark contrast to the Drift Protocol hack back in April 2026, where Circle was criticized for waiting more than six hours to freeze stolen USDC. The increased speed is a real success, but the response also shows how far apart issuers are. The first freeze on Ethereum landed 37 minutes after the exploit began, the last landed more than four hours later. Having the ability to freeze doesn't preclude the need for a standard on when to actually use it.
Predicate monitored the incident in real time and none of our customers were affected. Our team worked alongside them throughout, and several chose to freeze as a precaution. In this article we look at how each issuer responded to the hack. We also set out the baseline we believe every issuer should hold itself to, and how Predicate helps issuers get there.
How issuers responded
Every freeze on October 29th landed after the main drain had already finished. Across all chains, the industry froze about $2.8 billion. On Ethereum alone, Predicate's onchain analysis counts $2.16 billion frozen across seven assets.
The following table shows what each issuer froze, from largest to smallest amount:
Unfrozen assets
In an exploit, response time determines the outcome. An attacker's first priority is to convert freezable assets into assets that sit outside issuer controls. On October 29th, the main drain was complete in approximately 20 minutes, and approximately $786 million had been converted before the first freeze landed. The assets that remained unfrozen escaped through four routes:
Freezes arrived after the swaps. About $700 million in USDT moved before Tether's first freezes. On Ethereum, $334.5 million went through DEX and solver contracts, and on Tron 234 million USDT was swapped for TRX. One attacker wallet swapped RLUSD for 27 minutes before Ripple paused it, so 48 million of 88.5 million escaped. In total, about $482.5 million in USDT and RLUSD went through Uniswap and Curve pools within minutes, ending up mostly as WETH and WBTC.
Intermediate wallets. Funds kept moving through wallets nobody had frozen yet. One wallet was emptied 48 seconds before it was blacklisted. Another passed 175 million USDT to the next address, where it was frozen seven minutes later. Two wallets holding RLUSD were never paused, and Binance's wBETH was frozen one hop downstream, 56 minutes after it moved.
DeFi protocols became exit routes. The attacker posted 60 million USDT to Aave as collateral and borrowed ETH against it. Another 300 million USDT went into a JustLend vault, whose receipt tokens can't be frozen.
Native assets sit outside issuer controls. BTC, ETH, XRP, SOL and TRX can't be frozen by any issuer. About $3.2 billion remains in attacker-linked addresses, mostly ETH and BTC.
At this scale, every minute between detection and enforcement is worth millions of dollars.
Standards across the industry
No two issuers responded the same way. They differed on what triggers a freeze, how quickly it happens, how far it reached, and what got disclosed afterward.
The biggest difference is the trigger. Some issuers wait for a court order or a law-enforcement request. That gives them clear legal standing, and it avoids disrupting a payments token that businesses rely on for payroll and settlement. Others act on credible intelligence and work with authorities afterward.
In the case of an exploit, acting swiftly is preferable. Funds move in minutes, and a court order takes days. The theft is visible onchain to everyone. A timely freeze also holds funds in place while investigators do their work.
The GENIUS Act requires issuers to be able to freeze in line with lawful orders. What it doesn’t account for is major incidents that risk undermining market integrity or identified actions by rogue nations. We set out how compliance infrastructure should work under the Act in our comment letter to the U.S. Treasury. That leaves the decision to each issuer's policy based on their specific asset type and legal posture. The policy should be settled before an incident, not in the middle of one.
Build incident response into your controls from day one
Incident response belongs with the rest of your compliance controls: defined in advance and enforced in real time. October 29th gives a clear benchmark. The leading issuers acted in about 35 minutes, against a drain that took about 20. We believe every issuer, whatever its size, should be able to commit to the following:
A written freeze policy. Define the conditions under which you will freeze your asset(s). Examples include a confirmed exploit, a published law-enforcement address list, or a sanctions designation.
Clear decision rights. Determine what evidence is required in order to freeze. Many lost minutes are spent finding someone with the authority to act.
A time-to-freeze target in minutes. Aim to freeze within 30 minutes of a confirmed major exploit. That matches what the leading issuers achieved on October 29th.
Coverage of the whole path. Freeze the compromised source wallet and trace funds one or two hops downstream. On October 29th, every unfrozen intermediate wallet was a leak.
A defined path to release. Set out how/if victims can recover funds, and on what evidence.
How Predicate supports issuers
When an exploit occurs, time is of the essence for issuers to determine exposure and act in response. Predicate closes the gap between detection of an exploit and incident response, working as an extension of your compliance team, with intelligence and enforcement built into your digital assets.
Know your exposure. When an incident breaks, Predicate shows you:
How much of your asset is compromised, and where it is moving
Whether any sanctioned wallets hold a balance in your asset
Respond with guidance. Our team works through the incident with you in real time, mapping each decision to your freeze policy.
Enforce in real time. Predicate combines real-time sanctions monitoring and exploit intelligence from data providers with automated enforcement. Your rules are configured in advance and applied the moment they are triggered, with no manual coordination needed for each step. That can cut hours from response times and stop exploit-linked funds before they move again.
Freeze proposals. Predicate works with leading exploit analytics providers to detect an exploit as it begins, and immediately proposes a freeze with the context your approver needs: the attacker's wallets, the balance each holds in your asset, and the justification for freezing. One approval freezes every identified address at once. Available to all customers in December.
The case for shared standards
The GENIUS Act requires issuers to be able to freeze assets in line with lawful orders. It doesn't say when to freeze without one, how quickly to act, or what to disclose afterward.
Without that clarity, each issuer makes those calls under pressure, in the middle of an incident. On October 29th, that cost hundreds of millions of dollars in assets that moved before a freeze landed. The cost doesn't stop with individual issuers. As Predicate CEO Nikhil Raghuveera told the media, "sentiment will take a hit." Institutions moving onchain need confidence that a theft will be contained quickly, regardless of the assets involved.
Shared standards provide that confidence. Predicate is working with issuers, exchanges, networks and policymakers to define them, and building the controls that let every issuer meet them.
