EFRI Briefing | 31 October 2026
Briefing on a developing incident. Event figures reflect TRM Labs' snapshot of 00:30 UTC on 30 October 2026 unless stated otherwise.
At 20:24 UTC on 29 October 2026, an attacker emptied Binance's main Ethereum hot wallet. Thirty-seven minutes later, at 21:01 UTC, Tether blacklisted the receiving address, immobilising 971.1 million USDT. Circle froze 823 million USDC three minutes after that. By 00:30 UTC, TRM Labs counted roughly USD 2.7 billion of an estimated USD 6.36 billion theft beyond the attacker's reach.[1]
The speed is not the story. The timing is. When Tether acted, no one had publicly attributed the attack to North Korea; TRM's attribution came hours later. No court order had been issued, and none could have been within the hour. Tether has not disclosed any request from law enforcement; Circle states that it coordinated with law enforcement but has identified no order.[3] On the available record, close to a billion dollars was immobilised before any court had ruled on ownership, on the strength of evidence that a theft was in progress. The question this raises for victims of online fraud is not whether such intervention is possible. It is to whom it is available.
| Time UTC | Action | Scope reported at that stage |
|---|---|---|
| 20:24, 29 October | Main Ethereum sweep from Binance 14 | 167,464 ETH and 63 tokens, including approximately 1.615 billion USDT |
| 21:01 | Tether blacklists the main receiving address | Approximately 971.1 million USDT; four further attacker addresses restricted within 17 minutes |
| 21:04 | Circle freezes USDC in the same address | Approximately 823 million USDC; Circle states that it coordinated with law enforcement |
| 22:01 | Ripple restricts the address holding stolen RLUSD | Approximately 40.5 million RLUSD; about 48 million had already been sold |
| 22:10 | World Liberty Financial restricts USD1 | Approximately 27.8 million USD1 |
| 00:08, 30 October | Arbitrum Security Council emergency action | 8,425 ETH and 74,559,805.2 ARB moved to a restricted address on Arbitrum One |
Why the first freeze matters
Three things must be kept apart: the technical ability to stop a token, the legal basis for using it, and a decision on who is entitled to it. A blocklist function answers only the first. Sanctions law could have supplied the second: TraderTraitor is a unit of a sanctioned state, and Tether has applied voluntary secondary-market sanctions restrictions since December 2023.[2] But that rationale was not publicly available at 21:01 UTC. The most that can be said is that the first freeze rested on evidence of a hack in progress and, possibly, informal official contact, not on an identified sanctions nexus or a court order.
That is precisely the standard ordinary victims are told is not enough. After the Drift Protocol exploit of 1 April 2026, Circle declined to freeze stolen USDC while it moved across chains for hours. Its chief executive, Jeremy Allaire, said Circle freezes at the direction of law enforcement or the courts and that unilateral intervention would create a significant moral quandary.[4] In the last week of January 2026, New York Attorney General Letitia James and four district attorneys, including Manhattan District Attorney Alvin Bragg, told Senators Schumer, Gillibrand and Warner that Tether may freeze, burn and reissue USDT at law enforcement's request but acknowledges no legal obligation to do so, and that Circle acts only on a signed judicial order or warrant.[5] Circle's position has a serious rationale: an issuer that freezes on a claimant's word assumes an adjudicative role, faces liability without a safe harbour and invites misuse by false or competing claimants. The answer to that concern is not discretion but procedure.
The access channel
What distinguished Binance was not the size of its loss but its relationship with the issuers. Binance is the first partner in the T3+ programme of the T3 Financial Crime Unit, the public-private initiative founded by Tether, TRON and TRM Labs, which reports freezes within 24 hours of official requests in account-takeover and violent-crime emergencies.[6] An exchange in that position has a direct operational line to the issuer's compliance team. A retail victim has a police report and a transaction hash.
The individual route exists, but it is slow. In an Ohio case, bitcoin worth about USD 340,000 was stolen in February 2024 and converted into USDT. Tether froze about USD 200,000 in March 2024; a federal seizure warrant followed on 31 July 2024; on 3 October 2024 the United States filed a forfeiture complaint and said it would seek return to the victim if successful.[7] In EFRI's own Payvision/Option888 file, a European Investigation Order of 14 December 2017 took 228 days to produce a response from the Dutch acquirer.[8] In both cases the bottleneck was not the institution's capacity to act but the time it took a request to reach it in a form it would accept.
The obvious objection is that Binance is solvent and has committed to cover all losses from its own funds, so no vulnerable customer was at risk.[9] That strengthens the point rather than weakening it. Rapid preservation was delivered to the party that least needed it, through a channel that the parties who need it most do not have.
The legal frame in brief
The GENIUS Act is not yet in force; the OCC's final rule of 21 October 2026 confirms that the Act takes effect on 18 January 2027.[10] Section 4(a)(6)(B) will require issuers to have the technological capability to comply with lawful orders, defined in section 2(16) as final federal court or agency orders that specify the stablecoins with reasonable particularity. Section 4(a)(5) directs the Treasury to regulate procedures to block, freeze and reject impermissible transactions, but, as the Congressional Research Service notes, the Act does not say whether issuers should act on their own initiative or only on a lawful order.[11][12] Who may trigger preservation is left open.
MiCA regulates the authorisation, redemption and recovery plans of e-money token issuers (Articles 48, 49 and 55) but contains no counterpart to the GENIUS capability rule; Article 94(3) gives supervisors a power to request asset freezes only for their market-abuse tasks.[13] The more relevant instrument is Directive (EU) 2024/1260 on asset recovery and confiscation. Article 11 requires Member States to enable immediate action to preserve property pending a freezing order, and Article 11(3) allows asset recovery offices to take urgent measures for up to seven days. The transposition deadline is 23 November 2026.[14] The Directive operates through national authorities: it gives a victim no route to an issuer, and whether an asset recovery office can reach a foreign issuer's token contract in time is untested.
What the record does not show
Several limits apply. The figures are snapshots of a developing incident; Elliptic's later analysis counts USD 6.43 billion stolen and USD 2.85 billion frozen or seized.[15] Attribution to North Korea is TRM's high-confidence and Elliptic's likely assessment; no government has confirmed it. The 37 minutes measure elapsed time from outflow to freeze, not a service standard. Nothing in the record proves that issuers apply an undisclosed monetary threshold. A freeze is not restitution: return requires a decision on entitlement among competing claimants. Freezes also have limited reach. The attacker converted about USD 786 million in stablecoins before they landed, and nothing stolen on Bitcoin, the XRP Ledger or Solana has been frozen.[15] Finally, TRM Labs, on whose reconstruction this briefing relies, is a co-founder of the T3 Financial Crime Unit.
Our Assessment
The Binance case confirms the thesis that runs through EFRI's work: the institution that can stop the money is the pressure point. In online investment fraud it is the acquirer or the receiving bank; here it is the token issuer. The case also shows where the pressure point fails victims: not in capability, but in access.
Member States transposing Directive (EU) 2024/1260 by 23 November 2026 have an immediate opportunity to close that gap. EFRI calls on them, and on the Commission in its review of transposition, to ensure that:
- each asset recovery office has a designated, continuously available channel to the issuers of tokens offered in the Union, so that the urgent measure under Article 11(3) can be executed against a token contract within hours;
- victims and their authorised representatives can trigger an assessment by the asset recovery office on a published minimum evidence standard: chain, token contract, addresses, transaction hashes, timing, amount and basis of the claim;
- every urgent restriction carries a stated legal basis, a defined duration and prompt judicial review, with release where it is unjustified;
- preservation is followed by a separate route to restitution that resolves competing claims and commingled funds, with representative procedures so that small claims are not priced out;
- offices report aggregate data on requests, response times, refusals and amounts actually returned.
In the United States, the Treasury's rules under section 4(a)(5) of the GENIUS Act should answer the question the statute leaves open: whether, and on what evidence, an issuer may act before an order issues. An issuer able to restrict close to a billion dollars within the hour for an exchange should be able to explain, in advance and in public, how an ordinary victim can ask for the same.
EFRI will continue to report on the Binance case as the investigation, the treatment of the frozen assets and the transposition of Directive (EU) 2024/1260 unfold.
Sources
[5] Letter of New York Attorney General Letitia James and four New York district attorneys, including Manhattan District Attorney Alvin Bragg, to Senators Schumer, Gillibrand and Warner, last week of January 2026, as reported by CNN and The Block, 2 February 2026. Statements of the prosecutors, not adjudicated findings.
[6] T3 Financial Crime Unit (Tether, TRON, TRM Labs), announcement of 14 May 2026 via TRON DAO and The Block; Cointelegraph, Crypto crime unit with $250M in seizures expands with Binance (Binance as first T3+ partner).
[8] EFRI, Money Moves in Seconds. Europe's Evidence Requests Move in Months — If They Are Sent at All, 3 September 2026, Payvision section.
[9] CoinDesk, Binance arranges $6.34 billion to cover losses from record crypto hack, 30 October 2026.
[10] Office of the Comptroller of the Currency, News Release 2026-92 and Bulletin 2026-50, 21 October 2026; Federal Register Document 2026-21706, 23 October 2026.
[11] GENIUS Act, Public Law 119-27, 18 July 2025, sections 2(16), 4(a)(5), 4(a)(6)(B) and 20.
[13] Regulation (EU) 2023/1114 (MiCA), Articles 48, 49, 55 and 94(3).
[14] Directive (EU) 2024/1260 of 24 April 2024 on asset recovery and confiscation, Articles 11 and 33(1).
[16] Arbitrum Security Council, Security Council Emergency Action – 30/10/2026 (table).
