Insight by Snir Levi, founder of Nominis
On 29 October 2026, attackers drained roughly $6.3 billion in crypto assets from Binance, the world's largest cryptocurrency exchange. It is the largest crypto hack on record. Yet one of the most significant parts of the story is what happened in the hours that followed. Tether and Circle froze billions of dollars in stolen stablecoins almost as soon as the funds left Binance, which shows what the industry can achieve against illicit finance when the right intelligence reaches the right people in time.
.png)
What happened in the Binance hack
On the evening of Thursday 29 October, funds began leaving Binance hot wallets across ten blockchains, including Ethereum, Bitcoin, Tron, Solana and the XRP Ledger. Most of the assets were moved within around 20 minutes. Binance suspended deposits and withdrawals, confirmed that roughly $6.3 billion had been affected and said it would cover all user losses.
Binance's initial investigation points to a compromised laptop belonging to a DevOps engineer, which gave the attacker access to internal systems and allowed them to submit unauthorised withdrawals. The exchange has since said it found additional points of breach, and a full root cause has not yet been published.
The theft is roughly four times the size of the $1.5 billion Bybit hack in February 2025, the previous record. This theft was attributed to the DPRK and the methodologies in these cases are remarkably similar.
Yet again, in the Binance hack, the victim signed its own robbery. No private keys appear to have been stolen. Crypto wallets only release funds with their owners' signature, and since those signatures are almost impossible to forge, attackers now change what gets signed instead. In the Bybit hack, staff approved what looked like a routine transfer while the instructions underneath sent the funds to the attackers. At Binance, the attacker appears to have gone a step further, reaching the automated system that does the signing through a compromised engineer's laptop. Every lock worked as designed. The system simply trusted the wrong instructions.
The freezes that changed the outcome
Within hours, Tether froze around 1.57 billion USDT and Circle froze around 800 million USDC linked to the attack. With further action from other issuers and the Arbitrum Security Council, roughly $3 billion has now been frozen. Close to half of the largest crypto theft in history was stopped before the attackers could launder it.
This is one of the most encouraging responses to a major hack the industry has seen. Stablecoin issuers are often criticised for being slow to act on illicit flows, but this week showed that when an issuer wants to stop illicit funds, and has clear, verified information about where those funds are, it can act in hours rather than weeks. The infrastructure to freeze already exists. What decides the outcome is how quickly reliable intelligence reaches the people who can use it.
Applying the same approach to sanctions and terror financing
The response raises a wider question: why should this level of speed be reserved for record-breaking hacks? Stablecoins are also used by sanctioned entities, terror financing networks and fraud operations, and those flows rarely draw the same immediate attention.
The same model could disrupt illicit financing far beyond hacks, built on accurate attribution, fast information sharing between intelligence providers, issuers and exchanges, and decisive action. It only works, however, if the intelligence is precise enough to act on with confidence. A freeze on the wrong address harms legitimate users, while a freeze that comes too late lets the funds disappear.
What compliance teams must do now
The attacker still controls billions in assets that no issuer can freeze, including large holdings of ETH and BTC spread across dozens of wallets. As those funds are swapped and passed through intermediaries, compliance teams at exchanges, payment providers and OTC desks should act now rather than wait for the funds to appear in their own flows.
- Screen incoming deposits against the latest attacker-linked addresses. The list of wallets connected to the hack grows as funds move, so screening needs intelligence that updates in real time.
- Look beyond direct exposure. Most stolen funds will not arrive straight from the attacker's wallets. Teams need visibility into funds that have passed through several hops, swaps or protocols first.
- Review recent inbound transactions. Check deposits and transfers received since 29 October for any link to the incident.
- Have an escalation plan ready. Know who decides when to hold funds, file a suspicious activity report or contact law enforcement, so the team can act quickly when a match appears.
The Tether and Circle response shows that stopping illicit funds at scale is possible. The challenge now is making that speed the standard, for every platform and every type of illicit finance.
Stay ahead of illicit funds
Nominis provides wallet screening, transaction monitoring and forensic investigations that help compliance teams identify exposure to stolen and illicit funds before they reach their platforms. Talk to our team to find out how we can help.
All research content and accompanying reports are provided for informational purposes only and should not be relied upon as professional advice. Accessing these materials does not create any professional relationship or duty of care. Readers are encouraged to consult appropriately qualified professionals for guidance. We uphold the highest standards of accuracy in all the information we provide. For any questions or feedback, please contact us at contact@nominis.io.
