Arbitrum Freezes 74,559,805.2 ARB Tokens and 8,425 ETH After Binance Hack

Key Facts

On October 30, the Arbitrum Security Council froze 74,559,805.2 ARB tokens and 8,425 ETH linked to the address the network identified as connected to the Binance hack, and moved the assets to a designated freeze address on Arbitrum One. The council said in its announcement that the funds can be moved only through an ArbitrumDAO governance vote. The announcement identified the address to which the assets were transferred and said the action targeted funds linked to the hack on the network. It added that other users’ funds and applications were unaffected. The freeze places a specific portion of the assets involved in the incident under the network’s governance restrictions, but does not by itself mean the rest of the transferred funds have been recovered.

TRM said the attacker moved about $6.36 billion from Binance wallets to addresses under its control across 10 blockchain networks on October 29. Most of the transfers were concentrated within about 20 minutes, beginning at 20:05 UTC. Binance estimated the total impact at about $6.3 billion and said about $3 billion in assets had been frozen on-chain as of its October 30 update. The two figures are estimates from different parties about the incident, while the freeze figure describes what Binance said had been frozen by that update. TRM described the incident as the largest recorded cryptocurrency theft and estimated its scale at about four times the $1.5 billion Bybit hack in February 2025.

According to TRM, XRP transfers were the first outgoing movements the firm detected: 5 Binance-affiliated wallets sent about 233.46 million XRP to a single attacker address between 20:05 and 20:09 UTC on October 29. The firm valued those assets at about $296 million at the time of transfer and said the tokens remained at the address as of its report update. This detail shows that the $296 million figure relates to the initial XRP transfer, not the total funds TRM attributed to the attack. The firm estimated the value of the transferred assets at about $6.36 billion at the prices prevailing at the time of the theft, but said their value at report-writing prices had fallen to about $6.23 billion. It also said that at 00:30 UTC on October 30, the attacker still controlled about $2.4 billion in assets that it said were beyond issuers’ ability to freeze, including more than 420,000 ETH and 18,270 BTC.

The Arbitrum Security Council said the technical action was carried out atomically by upgrading the inbox contract on the Ethereum network to freeze the funds, then restoring the contract to its original implementation. Commenting on the cause of the incident, Binance said its initial investigation indicated that a DevOps engineer’s laptop may have been compromised, allowing the attacker to access a service container and send unauthorized withdrawal transactions. The platform added that it had found no evidence that wallet private keys had been leaked. TRM, meanwhile, attributed the attack with high confidence to North Korea’s TraderTraitor unit, based on on-chain and off-chain information. Binance’s account of the compromise remains the result of an initial investigation, while TRM offered its assessment of the attacker’s identity.

The response to the funds extended to other protocols: Aave said the response group had decided to freeze its markets across networks. It said the freeze prevents new deposit or borrowing positions from being opened, but allows users to repay and withdraw, while liquidations remain active. According to Aave’s update, the action covered 175 reserves on V3 across 16 networks and 117 reserves on V4 across 4 networks. Aave said one of the attacker group’s wallets deposited 60 million USDT as collateral and borrowed 19,762 WETH, worth about $44.6 million at the time, between 20:58 and 21:01 UTC on October 29. It said this position does not put Aave suppliers at risk.

In the market, the Associated Press reported that Bitcoin fell 3.2% on the evening of Thursday, October 29, to below $79,000. In its update at 00:55 UTC on October 30, Aave said ETH and BTC had fallen about 4% since the withdrawal, while tokens held by the attacker had declined by more: about 9% each for AAVE and LINK, 8% for UNI and 6% for ARB. In EL7 data, ARB closed at $0.1722 on October 28, then $0.1543 on October 29, before posting $0.1581 on October 30. Binance said it had temporarily suspended deposits and withdrawals pending completion of security checks. It added that it would publish a detailed technical review after the investigation and fact-checking were complete, while TRM said it was monitoring the relevant wallet addresses and expected possible next moves to include cross-chain bridges, swap services and over-the-counter brokers.