Tether says it froze over $1.5 billion in USDT linked to Binance hack

Tether says it froze more than $1.5 billion in USDT linked to the October 29 Binance cyberattack within 30 minutes. The FBI separately attributed the theft of more than $6 billion in virtual assets to North Korean activity it calls TraderTraitor.

Dji Banner Inside Article - 728x90

The freeze was announced by Tether on November 2. The company said its intervention prevented the affected funds from being transferred, exchanged for other assets or laundered. US authorities have previously warned that cryptocurrency theft is an important funding source for North Korea’s nuclear weapons programme.

Tether’s account of the response

Tether CEO Paolo Ardoino said:

“We have always said that USDT is the worst possible choice for criminals. Our response to the Binance attack shows why. Within minutes of the attack, our team froze more than $1.5 billion. The FBI confirmed that North Korea was behind the attack. Proactivity and speed are fundamental to how we work. We work every day to protect users and the digital asset ecosystem. Those who think USDT is a good place to hide stolen funds need to reconsider.”

Tether USAT CEO Bo Hines said:

“In crises like this, minutes matter, and Tether acted within minutes. We prevented those behind the attack from accessing more than $1.5 billion. This directly contributes to protecting US and global security. Protecting users, supporting law enforcement and keeping illicit funds outside the financial system are central to how Tether operates.”

The company continues to work with US and international law enforcement to track illicit fund movements, support efforts to bring those responsible to justice and prevent future attacks.

Previous interventions involving illicit funds

Tether describes the Binance response as the latest example of its law-enforcement cooperation. Following the theft of approximately $285 million from the Drift exchange by hackers linked to North Korea in April 2026, the company committed $127.5 million to a recovery plan intended to support affected users.

In the same month, more than $344 million in USDT held at two addresses was frozen in coordination with the US Treasury’s Office of Foreign Assets Control (OFAC) and US law enforcement. OFAC identified those addresses as linked to the Central Bank of Iran the following day. A further $130 million was frozen across four wallets in July, bringing Tether’s reported Iran-linked freezes during 2026 to approximately $550 million. The company also worked with the US Secret Service to freeze about $23 million associated with the sanctioned Garantex exchange.

Cooperation with more than 360 agencies in 73 countries

Tether says its wallet-freezing policy is aligned with OFAC’s Specially Designated Nationals and Blocked Persons List. Regarding allegations associated with the Blumenthal report, the company says it had frozen 99% of the addresses on the reported list before blockchain analytics provider Chainalysis labelled them as linked to Iran.

The company reports working with more than 360 law-enforcement agencies across 73 countries on investigations into illicit activity, including terrorist financing, and coordinating directly with the FBI and US Secret Service.

As of October 31, 2026, Tether says it had helped freeze more than 3,590 wallets containing approximately 1.6 billion USDT for the US Department of Justice, Secret Service and FBI. Its total frozen amount in secondary-market addresses, including funds linked to the Binance attack, exceeded 7 billion USDT. Most of those funds were associated with fraud and theft, particularly attacks on decentralised finance platforms and cryptocurrency exchanges.

The company also says approximately 1.2 billion USDT obtained through fraud and theft has been returned to rightful owners and law enforcement through token reissuance.

What the official sources establish

The FBI’s October 31 alert attributes the theft from Binance on or about October 29 to North Korea’s TraderTraitor activity. The more-than-$1.5-billion freeze and the 30-minute response time are Tether’s own account, rather than a separate FBI finding. A freeze prevents movement of tokens at the affected addresses; it should not be confused with a completed reimbursement to every affected customer.

Sources: Turkish Tether press release; Tether’s November 2 announcement; FBI alert dated October 31.