Binance Hack Losses Highlight Need for UK Stablecoin Freeze Rules

North Korea has been blamed by the FBI for the $6.3 billion Binance hack, a scale that analysts have described as the largest theft of its kind. But beyond the headline number, the case highlights a more operational question for the industry: what proportion of stolen funds can actually be contained once the money starts moving.

According to Elliptic, roughly $2.85 billion of the stolen amount was frozen after the attack. Of that frozen sum, about 94% was held in stablecoins—illustrating how centralized issuers can sometimes act fast enough to interrupt crypto crime in real time.

Key takeaways

• Elliptic estimates about $2.85 billion from the Binance hack was frozen, with stablecoins making up the vast majority of that figure.
• In the first hour of the hack, attackers reportedly swapped $325 million in stolen USDT for ether, seemingly trying to move funds out of assets that could be frozen.
• Tether and Circle froze the stolen USDC/USDT-linked holdings shortly after funds reached the hackers’ main wallet, limiting further fallout.
• Stability token freezes lack a widely agreed standard for when they should be triggered and how quickly issuers must respond.
• UK regulators can shape how stablecoins are made available on UK platforms, even though major issuers are not UK-based.

Why freezing mattered more than the theft

The most striking detail in the aftermath of the Binance hack is not only how much was stolen, but how quickly a large portion of it was rendered unusable. Elliptic’s reporting suggests the freeze was substantial enough to meaningfully reduce what attackers could ultimately retain.

That effectiveness appears closely tied to the underlying asset type. Stablecoins—unlike most other crypto holdings—can be frozen by their issuers. In practice, this creates a potential “interruption point” for victims: rather than waiting for law enforcement to track and seize assets after the fact, an issuer can block the movement of specific funds tied to criminal activity.

The implication for investors and market participants is straightforward: stablecoin controls can act as a risk-management tool in certain attack scenarios. Yet it also raises a governance challenge—if issuers can freeze billions, the industry needs clearer, fairer rules around that power.

The first-hour scramble and fast issuer action

Fast-moving hacks put issuers under time pressure. Earlier coverage from Cointelegraph noted that attackers moved quickly after the start of the Binance hack. Less than an hour in, attackers reportedly sold $325 million worth of stolen USDT for ether, effectively swapping an asset that could be frozen into one that could not be frozen by the same mechanisms.

Elliptic’s estimates suggest the freeze response still landed in time to block a large portion of the stolen stablecoin funds. The timing is important: according to the account summarized in this piece, Tether’s first major freeze occurred about 37 minutes after the stolen funds reached the hackers’ main wallet, with Circle freezing USDC about three minutes later. Without those issuer interventions, far more of the stablecoin value could potentially have escaped containment.

For traders, compliance teams, and exchanges, the episode reinforces a practical reality: in a stablecoin-heavy ecosystem, the availability and speed of freeze capabilities can meaningfully shape incident outcomes. It also underscores why attackers may aim to convert stablecoins into other assets immediately once they detect that a freeze could be possible.

The gap in freeze standards—and the legal fallout

Freezes can work, but the industry still appears to lack consistent standards governing when issuers should freeze funds and how quickly they should act. The piece argues that this uncertainty has real-world consequences.

One example cited is a proposed class action against Circle related to the Drift Protocol hack. The allegation is that Circle failed to freeze around $230 million in stolen USDC after an April attack, even though the funds were reportedly eligible for freezing.

Another example highlighted is litigation involving Tether in New York. Two businessmen allege that Tether froze millions of their assets months before a seizure warrant existed. The article notes that Tether has disputed the allegations and called them baseless.

These disputes point to a broader asymmetry in who bears the burden of speed. Banks typically freeze funds based on legal triggers and usually operate within defined processes that also allow for challenge. Stablecoin issuers, by contrast, often have to decide quickly in a cross-border environment—sometimes with limited visibility into formal legal status—while still facing serious legal exposure if victims or third parties claim freezes were delayed or premature.

UK-focused fixes: controlling access and setting expectations

Regulating stablecoin freezing is complicated by corporate geography. Tether and Circle are not based in the UK, limiting how directly British regulators can impose operational requirements on issuers.

However, the article argues the UK still has leverage through listing access. It points to the Financial Conduct Authority’s cryptoassets regime, under which UK trading platforms must carry out due diligence and publish a disclosure document before listing cryptoassets, including stablecoins issued overseas. The framework is scheduled to take effect on 25 October 2027.

The Bank of England, the piece says, is also finalizing a Code of Practice for systemic stablecoin issuers by the end of this year. That code is intended to cover stablecoins used widely enough for payments to matter to UK financial stability.

While the cited frameworks are described as still evolving and not explicitly setting detailed obligations around freezing stolen funds, the article contends this is precisely the moment for the UK to clarify expectations rather than retrofit them later.

Two conditions for stablecoins available on UK platforms

The editorial proposes a simple mechanism that could translate freeze authority into more predictable accountability. Before a stablecoin is sold on a UK platform, the issuer would need to agree to two conditions.

First: the issuer must be contactable and operationally ready to act. The article notes that, during the Binance hack, major issuers moved quickly—but it suggests smaller platforms and smaller operators may not have the same direct line to those issuers. That gap, it argues, increases the risk that smaller victims face delays.

Second: freezes should come with a clear timetable for what happens next. The proposal is that if an issuer freezes funds, it should notify the National Crime Agency the same day. The freeze would then expire unless a court order is issued to maintain the wallet freeze. The aim is to prevent indefinite freezing without legal grounding while still enabling fast action to stop stolen funds from spreading.

For UK users and market infrastructure, the underlying value proposition is that stablecoin freeze powers would be operationalized with rule-like guardrails: swift intervention when theft occurs, combined with time limits and an escalation path through legal processes.

The Binance hack case, paired with the lawsuits and allegations described above, shows both the promise and the danger of “instant” freeze authority. Investors and builders should watch whether UK regulators and licensed platforms move toward specifying freeze-related obligations—especially around response times, notification procedures, and limits tied to court review—so that containment efforts remain effective without becoming arbitrary.