Who could freeze the Binance loot, and how long each key took

At 20:24 UTC on 29 October, a Binance hot wallet on Ethereum sent about 63 tokens and 167,464 ETH to a single address in one transaction.LlamaRisk, Binance Hot Wallet Exploit: Aave’s Response, Aave governance forum, 30 October 2026. How a fake recruiter reached that wallet’s signing service is the story we traced on 5 November.The S-Curve, How a fake job interview reached Binance’s signing service, 5 November 2026. What happened next was a race between people who hold different kinds of keys.

Tether blacklisted the attacker’s address at 21:01:35 UTC and Circle followed at 21:04:59.Aave governance forum, Binance Hot Wallet Exploit: Aave’s Response, replies of 2 to 9 November 2026. Halborn’s timeline puts those at 37 and 41 minutes.Halborn, Inside the Largest Crypto Theft on Record, 4 November 2026. Aave’s emergency guardians froze their first markets at 21:42:11 and 21:47:23. In between, the attacker opened a loan on Aave.

Who holds a kill switch

These are three separate powers held by three separate groups. Stablecoin issuers can stop their own token. Aave’s guardian can stop lending against a list of assets. A third key, Arbitrum’s 12-member Security Council, briefly rewrote a core contract to move funds out of an address it did not control, as we reported on 5 November.The S-Curve, How Arbitrum’s council moved coins it held no key for, 5 November 2026.

Elliptic wrote in a 3 November analysis that freezing 44% of the stolen funds is unusual, against about 3% after the Bybit hack.Elliptic, How North Korea is laundering the $6.4 billion stolen from Binance, 3 November 2026. Global Ledger wrote that around 45% of the stolen value was frozen, compared with 9.52% across all hacks in 2025.Global Ledger, Six days after the Binance hack, 5 November 2026.

Totals differ by source. Elliptic puts the sum frozen or seized at $2.85 billion. Chainalysis wrote that about $2.8 billion had been frozen as of 3 November.Chainalysis, Binance exploit: latest findings and response, updated 3 November 2026.

The issuers’ blacklist

An issuer’s power sits inside the token itself. Tether and Circle can mark an address so that the token can no longer move from it. Tether said in a release that it froze more than $1.5 billion of USDT within 30 minutes of the hack.Tether, Tether Freezes Over $1.5 Billion From Binance Hack, 2 November 2026. Circle told American Banker it froze more than $1.1 billion of USDC, in coordination with law enforcement.American Banker, $6B Binance heist provokes stablecoin freeze dilemma, 30 October 2026. American Banker noted that this is larger than the 823 million USDC in the thieves’ wallet.

What a blacklist cannot stop is money that has already left. Halborn’s timeline says 700 million USDT left the hub between 20:30 and 20:33, before Tether acted, and Tether later caught 205 million of it downstream. Roughly 434 million USDT was sold for about 160,451 ETH through decentralised exchanges and market makers’ quote systems. Elliptic puts the stablecoins converted before the freezes landed at around $786 million. Some of it is still being worked: six home-made NEAR tokens tied to the laundering showed 249 buys on 9 November and almost no outside buyers at any point, as we found this week.The S-Curve, Laundering meme coins tied to Binance hack traded again on 9 Nov, 10 November 2026. Ripple and World Liberty froze their tokens later, and Tether blacklisted Binance’s own hot wallet at 22:06.

The loan that got through

Between 20:58 and 21:01 UTC, one wallet in the attacker’s cluster supplied 60M USDT on Aave and borrowed 19,762 WETH, worth about $44.6M at the time, LlamaRisk wrote on the Aave governance forum. A forum member posting as 0kage.eth counts 3m36s from the first deposit to Tether’s blacklist.

The stablecoins backing the loan were frozen minutes later, but a frozen coin still counts as collateral. LlamaRisk wrote that the position holds $59.9M of USDT against $43.8M of debt, remains subject to normal liquidation, and does not put Aave suppliers at risk. The ETH was already gone.

What Aave’s guardian is

The Protocol Emergency Guardian is a multisig, a wallet that needs several signers to approve each action. Aave Labs wrote on the governance forum in May that it can pause markets and freeze reserves across all Aave deployments on 19 networks,Aave Labs, Aave Emergency Guardian (Protocol): Signer Rotation, governance forum, 20 May 2026. that the threshold is 4 of 7, and that signers are not publicly named, to limit social-engineering risk.

The documentation separates two tools. A frozen reserve allows no new supply or borrow but still allows repayments, liquidations and withdrawals, and freezing sets its loan-to-value ratio to zero.Aave V3 documentation, Pool Configurator. A paused reserve allows no interaction at all.

LlamaRisk gave its reasons for the design of the response. It joined Aave Labs, TokenLogic and Certora in a war room within 10 minutes of the first reports, and the group decided to freeze Aave markets across all networks. The exploiter could swap stolen funds into any listed asset, LlamaRisk wrote, so freezing only the stolen tokens would have left other ways in. It chose a freeze because the guardian can reverse it, while cutting caps would have needed a governance vote and about five days to restore. The guardian multisigs executed the transactions between 21:42 and 23:04 UTC, freezing 175 reserves on Aave V3 across 16 networks and 117 on Aave V4 across four. The Horizon real-world-asset market stayed open because its collateral is permissioned.

Forty minutes, and a question

LlamaRisk wrote that the position was opened about 40 minutes before the first freeze at 21:42, and that no exploiter wallet has interacted with Aave since 21:01. 0kage.eth counts 43 minutes from the first borrow to the V4 freeze and 48m12s to the first V3 Core freeze, and notes that the issuer actions targeted specific wallets, not the whole cluster.

The same member asked LlamaRisk what residual risk justified a broad freeze after Tether and Circle had blacklisted the attacker’s wallet, and why existing supply and borrow limits were insufficient. LlamaRisk’s stated reasons are above: a freeze reaches any listed asset, and the guardian can undo it. It also reported a cost: because a frozen reserve takes no new supply, users could not add collateral, so repaying was the only way to raise a health factor while the freeze lasted.

The unwind

To avoid reopening everything at once, Risk Steward batches cut borrow caps during the freeze, removing about $3.7B of unused borrow capacity on V3 and $130M on V4, LlamaRisk wrote. The rollback ran in four guardian waves, and by 30 October all V3 reserves were unfrozen with LTV kept at 0. On 2 November the guardians restored LTV for non-stablecoin assets at 15:55 UTC on V3, and every restored reserve returned to its pre-freeze configuration. USDT, USDC and USDT0 stay at LTV 0 on V3 and at a collateral factor of 0 on V4.

The key that was not there

Fiat money has no guardian on a clock. ZachXBT wrote on his Telegram channel on 2 November that an EU entity was suspected of losing more than $106 million from centralized exchange accounts the day before, withdrawn as USDC and USDT.ZachXBT, Investigations channel on Telegram, 30 October to 4 November 2026. A day later he put the total at more than $133 million and said the institution was allegedly Crédit Mutuel Arkéa. He said more than $30 million was laundered away that EU law enforcement could have frozen, for want of a proper incident disclosure. The bank says attackers used its own account to send money to other banks, and public Kraken trades show euros turning into USDC minutes before withdrawal, as we reported on 4 November.The S-Curve, The Arkéa theft left a trail in Kraken’s euro market, 4 November 2026.

On-chain, a freeze needs a key holder awake. In fiat, on ZachXBT’s account, it waited on the victim to speak.