Freeze of Assets Linked to Binance Hack Opens a Path That Could Take 49 Days
Key Facts
Arbitrum’s Security Council froze assets linked to an address it said was connected to the Binance hack in an emergency measure carried out at 8:08 a.m. Hong Kong time on 30 October 2026. The council said the intervention moved the funds into custody, while their release remains under consideration through the network’s governance process. The move follows a major theft involving assets across multiple networks, though the council’s announcement did not specify the value of the frozen assets. It said the measure did not affect other users’ funds or applications. A subsequent governance proposal links access to the funds to stages of discussion, voting and execution, on the condition that no legal action prevents their transfer.
The council explained that the operation involved a temporary upgrade to an Inbox contract on Ethereum, adding a function that allowed cross-chain transactions to be created that mimicked the exploiter’s address. According to its account, two such transactions were used to transfer funds linked to the hack, after which the contract was returned to its original implementation as part of the same measure. The council described this as a sequence combining the contract upgrade, transfer of the funds and restoration of the contract to its original state. It said the transactions mimicked the address associated with the attack, allowing the assets to be moved without leaving the temporary contract change in place. It said the operation did not affect other users or applications.
Binance estimated that the approval process for releasing the funds would take about 49 days under the schedule published on 5 November 2026. The schedule allows one week for forum discussion, followed by one week for a temperature check vote and two weeks for an on-chain vote. After the vote concludes, execution of the final transaction would take about 18 days. These stages make the release decision separate from the freeze itself, as governance approval is required before the funds can be transferred. The timeline could be longer if a legal proceeding needs to be resolved first.
The proposal says it will not be put to an on-chain vote and the funds will not be transferred while a restrictive notice, court order or legal proceeding prevents the transfer. The transfer can proceed only if a competent court modifies or lifts that measure. The proposal also includes an undertaking by Binance to indemnify the Arbitrum Foundation, Offchain Labs, the Security Council and its members against claims and expenses related to the freeze and release. The text requires the indemnity agreements to be executed before the proposal is submitted to an on-chain vote. These conditions place legal restrictions and indemnities within the proposed process for releasing the funds.
Binance said about $6.34 billion in virtual assets were affected by the incident, and that about $2.85 billion had been frozen or intercepted as of its update published on 3 November 2026. It said the attacker exploited unauthorized access to an internal signing service, then used the EIP-7702 delegation mechanism to give a contract under its control partial execution permissions over a hot wallet. CoinDesk estimated that about $2.5 billion was withdrawn from a Binance wallet via Ethereum in less than four minutes on 29 October, as part of a broader theft across several networks. Binance said unauthorized withdrawals continued for about four hours after the first theft. These figures show the difference in scope between the funds withdrawn via Ethereum and the total assets affected by the incident.
EL7 data showed that ARB’s closing price against the dollar was $0.164 on 31 October, then fell to $0.1557 on 2 November, before rising to $0.1649 on 6 November. These moves came in the period following the freeze and the announcement of details about the incident and the proposed governance process. In the broader market, reports published on 29 and 30 October said Bitcoin and Ether had fallen to low levels before the market stabilized. Binance said it would compensate customers whose funds were stolen, while Reuters reported that it had allocated about $6.34 billion in company funds to cover losses. The next development concerning the frozen assets remains tied to the stages of discussion, voting and execution set out in the proposal.