Binance hack: frozen funds are not necessarily recovered funds

Figures reflect different measurement times

In its October 30, 2026 update at 8:00 UTC, Elliptic says it verified approximately $2.84 billion in frozen funds following the Binance hack. That amount belongs to a dated assessment; it should not be presented as a continuously updated balance. TRM Labs published another assessment with an earlier cutoff and its own scope and valuation. These figures are not additive, because they describe interventions involving the proceeds of the same theft at different points in its monitoring.

The word freeze also covers situations that need to be specified. Preventing a token from moving, transferring an asset beyond an attacker’s reach, and returning it to the victim are distinct operations. A rigorous account must identify which operation was observed, by whom, and when. Without those reference points, an immobilized amount can be mistaken for money already back in the exchange’s reserves, or even for reimbursement already credited to users’ accounts.

Issuers have different powers

The analyses describe interventions by stablecoin issuers, particularly involving tokens whose contracts allow addresses to be blocked. That ability depends on the asset’s design and the issuer’s powers. It does not automatically extend to a network’s native currency. Elliptic highlights the difference between issued tokens and assets such as bitcoin or ether, for which no central issuer has a comparable function. Converting stablecoins into native assets can therefore change the available intervention options.

Arbitrum provides an example of a different mechanism. TRM describes an action by its Security Council that moved assets beyond the attacker’s reach. That kind of network intervention should not be equated, without explanation, with putting an address on a stablecoin blocklist. The actors able to act, the operations executed, and their effects differ. Describing every measure with the same verb would obscure information needed to understand what was actually secured.

Immobilization does not settle restitution

The same caution applies to lending protocols. Elliptic distinguishes freezing markets, which can prevent new activity, from seizing assets already committed to a position. A halt in activity therefore does not justify announcing that collateral held in a protocol has been recovered. The specific operation, rights over the assets, and observable movements need to be examined. This distinction also avoids counting amounts repeatedly when they appear in succession in a wallet, a collateral position, and an intervention report.

Monitoring the incident will require separate reconciliation of amounts stolen, immobilized, placed under secure control, and ultimately returned. Confirmed restitution must rest on new evidence, rather than the mere passage of time since a freeze announcement. Investigative estimates can change with prices, identified addresses, and scope. At this stage, the reported interventions show that some movements were prevented or limited; they do not establish that Binance has recovered all the affected assets or that the final loss has been conclusively determined.