Binance Hack: Freeze First, Ask Questions Later
The theft of USD 6.3 billion in cryptoassets from Binance, the private freezes that followed within the hour, and the limits of what the English courts can do about the rest
The facts as reported
At 20:05 UTC on 29 October 2026, assets began leaving Binance hot wallets on ten blockchains. According to TRM Labs, about USD 6.36 billion moved, most of it within twenty minutes; Chainalysis puts the figure between USD 5.9 and 6.4 billion, and Binance itself at about USD 6.3 billion. The largest components were some 200,000 ETH, 1.875 billion USDT and 823 million USDC on Ethereum, and 18,270 BTC. On any of those figures it is roughly four times the Bybit theft of February 2025 and the largest on record.
Binance said at first that its investigation pointed to a compromised laptop belonging to a DevOps engineer, through which the attacker reached a service container and submitted unauthorised withdrawals, and that it had "found no evidence of any private key leaks from wallets". By the morning of 30 October it had moved: "our subsequent investigation has uncovered additional points of breach", and the incident was "a complex attack". Its co-chief executive Richard Teng said the investigation "has not attributed responsibility to any individual". Blockaid and TRM read the events as a compromise of the signing infrastructure rather than a leaked key. Binance says user funds are safe, that it will cover all losses from its insurance fund and company money, and that it has set aside "more than $6.34 billion in company funds" for the purpose, about USD 5 billion of it already held in the affected tokens and the balance being bought in the market. A full post-mortem is promised. TRM attributes the attack with high confidence to TraderTraitor, the North Korean unit the FBI linked to Bybit. Chainalysis states "a high degree of confidence" in the same attribution, its investigators having "observed funds from last month's DPRK-linked Bitget exploit commingling with funds stolen from Binance"; the investigator ZachXBT reports the same commingling after the funds passed through THORChain. Binance has not confirmed any attribution.
The private freeze
Tether froze 971 million USDT in the main receiving wallet at 21:01 UTC, fifty-six minutes after the first transfer. Circle froze 823 million USDC three minutes later, in coordination with law enforcement. Ripple, World Liberty Financial, First Digital and the Arbitrum Security Council followed, and Aave froze its lending markets as a precaution. By 23:35 UTC Binance reported a verified frozen total of USD 2.54 billion; by 00:52 UTC on 30 October it put the figure at about USD 3 billion and said it may rise. None of them was a court order.
The stablecoin freezes rest on the issuers' control of their own token contracts; the Arbitrum Security Council used its separate powers over that network. The sum immobilised within the hour exceeds the entirety of the Bybit theft, the previous record. In this case, therefore, the first decision about the stolen stablecoins was taken by their issuers, not by any court.
A freeze is not a forfeiture, and it is not a return. Most of the frozen tokens sit in wallets the attacker still nominally controls. Converting a freeze into recovery requires either the issuer's willingness to reissue or an order from a court or enforcement authority directing what is to happen to them. The first part of the recovery was fast and private. The second part will be slow and legal.
Property
Section 1 of the Property (Digital Assets etc) Act 2025, in force on Royal Assent on 2 December 2025, provides that a thing, including one "digital or electronic in nature", is not prevented from being the object of personal property rights merely because it is neither a thing in possession nor a thing in action. It is an unlocking provision; it declares no particular asset to be property and leaves the detail to the common law.
The difficulty the Act answers was doctrinal. Personal property was understood to divide into things in possession and things in action; a token is neither, because it cannot be possessed and embodies no right enforceable by action. Bryan J set out that difficulty in AA v Persons Unknown [2019] EWHC 3556 (Comm) at [55] and resolved it by holding that Bitcoin is nonetheless property ([59]). That line of cases was decided on interim applications, where a good arguable case sufficed ([108], [112] of D'Aloia); the judge in D'Aloia recorded that counsel "had not identified any previous case in this jurisdiction where the question had to be decided at trial" ([104]).
The common law had reached the same point before the Act. In D'Aloia v Persons Unknown [2024] EWHC 2342 (Ch) the High Court held at first instance that USDT "attract property rights under English law", that it is "a distinct form of property not premised on an underlying legal right", and that it "can be the subject of tracing and can constitute trust property in the same way as other property" ([5]). In DPP v Qian [2026] EWHC 2509 (KB), the civil recovery proceedings over more than 61,000 BTC, Turner J recorded that AA v Persons Unknown and D'Aloia "have confirmed that this is the position at common law" ([25]).
Following the money
The difficulty is proof, and D'Aloia illustrates it. The claimant's USDT was said to have passed through a chain of wallets into an exchange, Bitkub. The court held that common-law tracing through a mixed fund was not available ([7(i)]); that USDT could in law have been followed, but on the facts was not ([7(ii)]); and that the expert evidence on both sides was "not ... especially helpful" ([48]). The claim against Bitkub failed because the claimant could not show that any of his funds had entered the relevant wallet ([6], [8]). That was so although the court found that Bitkub had actual notice of suspicious activity on the account ([12], [23]) and rejected its defence of bona fide purchase ([24]).
The laundering now under way is designed to produce that evidential failure. TRM reports about 325 million USDT sold through UniswapX to market makers and solvers at a discount of more than ten per cent, 60 million USDT deposited into Aave against borrowed ETH, 300 million USDT supplied to JustLend on Tron, and the Bitcoin being moved through a peel chain: a long sequence of wallet-to-wallet transfers in which a small amount is peeled off at each step and sent on for conversion, while the bulk moves to a fresh address. Each transfer from one wallet to the next, a "hop" in the language of D'Aloia, may mix the stolen tokens with others or change their form, and in any event lengthens the chain that a claimant must later reconstruct. Chainalysis reported on the morning of 30 October that its investigators were "observing never-seen-before laundering patterns with the stolen funds".
The D'Aloia questions will therefore be asked of a new set of parties: the counterparties who bought stolen stablecoin at a discount within hours of the theft. Whether a buyer at ten per cent below market, within those hours, is a bona fide purchaser without notice is a question of fact. The general test for notice is Lord Sumption's in Crédit Agricole Corporation and Investment Bank v Papadimitriou [2015] UKPC 13 at [33]: "if there are features of the transaction such that if left unexplained they are indicative of wrongdoing, then an explanation must be sought before it can be assumed that there is none". D'Aloia applied that test to the exchange's good faith ([295], [306]) but, having found actual notice, declined to say what standard of notice defeats a purchaser of cryptoassets ([23], [381]). That question is open, and a discount of ten per cent within hours of the largest theft on record is the kind of feature that calls for an explanation. The answer will also turn on expert tracing evidence that is methodologically sound, transparent about its choices and even-handed between victims. In D'Aloia the evidence met none of those requirements, and that failure was fatal to the claim ([221], [263], [264], [382]); independently, the tokens the exchange had received were already paid away and no claim in knowing receipt had been pleaded ([383]).
The state's tools
Chapters 3C to 3F of Part 5 of the Proceeds of Crime Act 2002, inserted by the Economic Crime and Corporate Transparency Act 2023 and in force in England and Wales since 26 April 2024, give enforcement authorities a civil route to recovery. A crypto wallet freezing order is available where the court is satisfied that there are "reasonable grounds for suspecting" that cryptoassets in the wallet are recoverable property or intended for use in unlawful conduct (s.303Z37(2)); the application must be made or authorised by a senior officer (s.303Z36(3)); the order may run for up to two years, extendable to three where a formal request for evidence of a kind the section specifies, including a request by an enforcement officer to a foreign authority, is outstanding (s.303Z37(4) to (7)). Forfeiture follows in the magistrates' court on the same two limbs (s.303Z41(2), (4)). A person who claims that the frozen cryptoassets belong to him may apply for their release (s.303Z51).
The reach of those orders is defined by the custodian, not the thief. A freezing order may be sought only over a wallet administered by a "UK-connected cryptoasset service provider": one that carries on business in the United Kingdom, or whose terms submit disputes to a United Kingdom court, or which holds customer data here, or has its registered office here (or, having none, its head office) with the business managed from this country (s.303Z36(1), (8), (9)). That catches stolen value once it lands in a customer account at an exchange or broker with those connections. It does not catch the attacker's own addresses, controlled by the attacker's own keys, for which no exchange or custodian provides any service (s.303Z36(4)(b)); and that is where the tokens frozen by the issuers now sit. For those, the state has two routes. Chapter 3C lets an enforcement officer search for and seize a "cryptoasset-related item", meaning a device or anything that gives access to the keys (s.303Z21), and seize the cryptoassets themselves by transferring them into a wallet the officer controls (s.303Z29); both require reasonable grounds for suspecting that the assets are recoverable property or intended for use in unlawful conduct. Beyond that lies the general civil recovery regime in Part 5, which is how the Qian Bitcoin was taken: devices and keys seized, then a property freezing order over the assets (the agreed statement of facts set out at [5], paragraphs 24 to 26). Neither route works unless an officer can lay hands on a device, a key or a person within the jurisdiction.
Qian also shows the complication that follows a successful recovery. Thousands of victims claimed the Bitcoin as theirs under section 281. Turner J had first to decide which law governs whether the Bitcoin "belongs to" them, and held, on facts agreed between the parties for that purpose ([4], [5]), that it is Chinese law, with English law supplying only the Part 5 procedure through which those rights are asserted ([186], [238], [246]).
The residue
Binance says it will absorb the loss, so the loss falls on the exchange, not its customers. The thief, if TRM is right, is a state actor, and recovery from a state actor through litigation is not a realistic prospect. If the attacker is an organ of the state, the State Immunity Act 1978 makes it immune from the jurisdiction of the English courts except within the exceptions the Act lists (s.1(1), s.14(1)). None of those exceptions fits the theft of intangible tokens: the exception for damage to property is confined to tangible property and to acts or omissions in the United Kingdom (s.5), and a token is not tangible property. Even a judgment could be enforced against a state's property only with its written consent or where the property is for the time being in use for commercial purposes (s.13(2)(b) to (4)). North Korea is the subject of United Nations Security Council sanctions, given effect here by the Democratic People's Republic of Korea (Sanctions) (EU Exit) Regulations 2019, whose stated purposes include "restricting the ability of the DPRK to carry on banned programmes" and "the decommissioning of the DPRK's banned weapons" (reg. 4(2)). TRM's Ari Redbord has said that when North Korea steals at this scale "the money funds weapons proliferation and other destabilising activity". A state in that position cannot be expected to answer a claim, disclose assets or return money; the United Kingdom's dealings with it have been conducted through sanctions rather than litigation.
The disputes that follow will concern the roughly USD 3 billion of frozen tokens, who may direct the issuers to release or reissue them and in what forum, and the counterparties who bought at the discount. English law has recognised that stablecoins and other cryptoassets are property. What it has not yet shown is that it can act at the speed the asset moves. In AA v Persons Unknown the ransom was paid on 10 October 2019 and the proprietary injunction over the Bitcoin was granted on 13 December 2019, two months later, after the insurer had traced the coins to an exchange. That is fast by the standards of litigation. Tether acted in fifty-six minutes, on its own authority, through a freeze function written into the USDT token contract and exercisable by Tether. Whilst the courts can decide who owns the frozen tokens, it is doubtful that an injunction could have been obtained and served before the funds moved.
Comments