Binance Hack: Who Can Recover $3 Billion in Frozen Crypto?

The Binance hack investigation of October 29, 2026, has raised a fundamental legal question: who can recover billions of dollars in cryptocurrency frozen across national borders? Binance now estimates that approximately $6.3 billion in digital assets was affected, with around $3 billion frozen through cooperation with blockchain companies and other industry participants. Yet immobilizing cryptocurrency does not establish who legally owns it or who has the authority to return it. Stablecoin issuers can restrict certain tokens, while compulsory seizure, confiscation, and restitution generally require competent national authorities and applicable legal procedures (Binance, 30 October 2026).

The investigation has developed substantially since the initial reports. Binance’s preliminary findings suggest that a compromised DevOps engineer’s laptop may have enabled an attacker to access an internal service container and submit unauthorized withdrawal transactions. The exchange reports no evidence that wallet private keys were leaked. Blockchain intelligence company TRM Labs has also attributed the incident to North Korea’s TraderTraitor operation with high confidence, although that assessment remains distinct from a formal legal determination of state responsibility (TRM Labs, 2026).

The international legal questions extend across several jurisdictions. Binance operates through entities regulated in the Abu Dhabi Global Market, Tether International is incorporated in El Salvador while retaining British Virgin Islands contractual governing-law provisions, and Circle maintains American, European, and other issuing arrangements. The intervention of Arbitrum’s Security Council adds another dimension: network governance mechanisms can also immobilize cryptocurrency without resolving its legal ownership. International law governs important aspects of jurisdiction, state responsibility, and cooperation between national authorities, but the ultimate recovery and distribution of assets ordinarily depend on domestic law, property rights, contractual obligations, and judicial procedures.

On October 29, 2026, substantial cryptocurrency transfers from Binance-associated wallets prompted an investigation into a suspected security breach. Early reporting described suspicious movements involving several billion dollars, including large transfers of Ether and stablecoins. The incident affected wallets operating across multiple blockchain networks, complicating attempts to determine the extent of the losses and identify the individuals controlling the receiving addresses.

Binance subsequently acknowledged a security incident and published preliminary findings on October 30. The company estimated the total financial impact at approximately $6.3 billion and reported that about $3 billion in affected assets had been frozen on-chain. It also announced that customer losses would be covered through its Secure Asset Fund for Users (SAFU) and company resources (Binance, Security Incident Update, 30 October 2026).

The investigation raises separate technical and legal questions. The technical inquiry concerns how an attacker may have obtained authorization to move assets across numerous networks. The legal inquiry concerns the powers of token issuers, exchanges, network governance bodies, national authorities, and courts. Neither the identification of suspicious transfers nor the immobilization of assets conclusively determines the identity of the perpetrators or the eventual distribution of the cryptocurrency.

Initial estimates of the suspected Binance losses varied considerably. Blockchain security company Blockaid identified approximately $3.3 billion in suspicious outflows, while other preliminary assessments suggested that as much as $5.8 billion could be implicated. These figures reflected different transaction sets and investigative methods rather than a completed assessment of the total loss (The Block, 29 October 2026).

On October 30, Binance estimated the total impact at approximately $6.3 billion. Blockchain intelligence company TRM Labs separately reported tracing approximately $6.36 billion in transfers from Binance-associated wallets across ten blockchain networks. TRM calculated the value of the transfers using the prices of the relevant assets when they were moved, providing a more developed reconstruction than the initial estimates (TRM Labs, 2026).

According to TRM’s analysis, the transfers involved Ethereum, Bitcoin, Tron, the XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche, and Polygon. The company reported that most of the value was transferred within approximately 20 minutes, although additional suspicious movements occurred later. The affected assets included Ether, Bitcoin, USDT, USDC, XRP, SOL, and other tokens.

The technical evidence suggests that the operation extended beyond a single compromised Ethereum wallet. On Ethereum, investigators identified transactions involving Ethereum Improvement Proposal 7702, which enables an externally owned account to delegate execution to smart contract code. TRM reported that the attacker used previously signed authorizations to install code capable of transferring assets from a Binance-associated wallet, including assets subsequently received by that address.

Other blockchain networks displayed different transaction patterns. TRM reported that wallets using distinct signature schemes generated apparently valid transactions transferring assets to attacker-controlled addresses. The company interpreted this activity as consistent with unauthorized access to Binance’s signing infrastructure, rather than an isolated vulnerability affecting one blockchain.

Binance’s October 30 statement supplied a possible explanation for this broader access. Its preliminary investigation suggested that a compromised DevOps engineer’s laptop may have allowed an attacker to enter a service container and submit unauthorized withdrawal transactions. Binance stated that it had found no evidence of leaked wallet private keys and promised a detailed technical account once the investigation was complete.

The findings are not necessarily contradictory. An attacker could potentially misuse a system capable of authorizing transactions without obtaining the underlying private keys directly. Nevertheless, the precise relationship between the compromised computer, the service container, the EIP-7702 authorizations, and other signed transactions remains subject to forensic investigation. Binance had not published a final determination of the security failure.

The first substantial interventions were reported on October 29. Tether announced restrictions affecting approximately 1.567 billion USDT, while Circle reportedly blocked more than $800 million in USDC. Reuters reported that their combined action had immobilized more than $2.38 billion in stablecoins (Reuters, 29 October 2026).

Additional restrictions followed as investigators identified more addresses and assets. On October 30, Binance reported that approximately $3 billion had been frozen on-chain through cooperation with blockchain partners. The company presented this as its current confirmed total, replacing the narrower figures available during the initial reporting (Binance, Security Incident Update, 30 October 2026).

TRM Labs independently estimated that approximately $2.7 billion had been immobilized through stablecoin issuers and the Arbitrum Security Council by the early hours of October 30. Its analysis identified interventions involving Tether, Circle, Ripple, and World Liberty Financial, alongside the emergency action taken on Arbitrum One.

The difference between TRM’s estimate and Binance’s approximately $3 billion figure reflects reporting based on different information and observation times. It does not establish that either total represents cryptocurrency already returned to its owners.

The extent of the freezing also differs by asset. Stablecoins issued through centrally administered contracts may be subject to address restrictions, while native cryptocurrencies such as Bitcoin generally lack an equivalent issuer-controlled mechanism. Some affected assets were transferred, exchanged, or used in decentralized financial arrangements before restrictions were imposed.

The financial implications remain substantial. Even accepting Binance’s estimated $6.3 billion impact and approximately $3 billion frozen, the difference cannot automatically be treated as a final unrecoverable loss. Cryptocurrency values fluctuate, and additional tracing, restrictions, seizures, or voluntary transfers may alter the amount eventually secured.

The reported freezes preserve potentially recoverable property, but legal recovery remains a separate process. As of October 30, the publicly available statements did not establish that the frozen assets had been judicially confiscated, that all ownership claims had been resolved, or that restitution had been completed.

Several institutions may exercise authority over cryptocurrency implicated in a suspected theft, but their powers arise from different legal relationships. Stablecoin issuers can restrict transfers through administrative functions within their token contracts. Exchanges may suspend withdrawals or restrict assets they hold in custody. National authorities can investigate suspected offenses and, where the law permits, obtain orders to preserve or seize identifiable property.

The legal process may involve several distinct operations. Blockchain tracing identifies transactions and addresses without changing control of the assets. Issuer blocklisting prevents certain token movements, while judicial seizure places property under legally authorized control. Forfeiture or confiscation may subsequently alter ownership, and restitution determines whether and how the property is returned to a legally entitled claimant.

The distinction also concerns enforcement jurisdiction in international law. A state may possess criminal jurisdiction over an offense without having authority to exercise coercive powers within another state’s territory. Compelling a foreign entity to surrender assets may require cooperation, recognition of a legal order, or another valid jurisdictional basis. No international institution automatically acquires the power to distribute cryptocurrency because transactions have crossed national borders.

Tether issues USDT through token contracts that support administrative restrictions on applicable blockchain networks. Its Token Terms of Sale and Service, updated February 26, 2026, reserve powers to suspend services, restrict wallets, and freeze tokens in circumstances involving legal requirements, contractual violations, or decisions the company considers necessary under its stated policies (Tether, 2026).

These powers must be distinguished according to their legal basis. A freeze imposed pursuant to a binding court order differs from voluntary cooperation with investigators or a restriction justified under contractual provisions. Tether’s technical ability to immobilize tokens does not independently establish a governmental power of confiscation.

The company’s terms also address rights concerning tokens and other property held through its services. However, provisions governing direct customers do not necessarily establish identical obligations for every person holding USDT acquired on a secondary market. Whether a particular contractual provision binds an affected holder requires examination of the relevant relationship and applicable law.

Freezing USDT ordinarily prevents specified token movements while the restriction remains effective. Subsequent cancellation, reissuance, or transfer of economic value may involve additional technical arrangements and legal authority. Tether’s participation in an investigation does not establish that Binance automatically owns the frozen tokens or that an investigator may distribute them without determining the rights of affected parties.

Circle’s Stablecoin Access Denial Policy permits address blocklisting in specified circumstances. Its published explanation identifies compliance with applicable law, valid orders from competent authorities, certain urgent government requests, and threats to the security or integrity of its stablecoin network as possible grounds for intervention (Circle, Understand Circle’s Stablecoin Blocklisting Process, 2026).

Blocklisting prevents a designated address from sending or receiving USDC under the relevant implementation. Circle expressly distinguishes this operation from reversing a completed transaction. An earlier transfer remains recorded on the blockchain even if the recipient address is subsequently restricted.

Circle’s USDC Terms, updated October 15, 2026, distinguish holders with Circle Mint accounts from holders who possess USDC without such accounts. The terms designate the first category as User Type A and the second as User Type B. Circle states that its terms apply to both categories outside the European Economic Area, although certain services and obligations are expressly limited to account holders.

This distinction has consequences for recovery. Under Circle’s published terms, direct redemption of USDC for U.S. dollars ordinarily requires an eligible Circle Mint account in good standing. A User Type B holder cannot simply demand direct redemption without satisfying the conditions for establishing that relationship. Restrictions arising from applicable law or proceedings may create additional obstacles.

A reported Circle freeze does not establish which legal ground justified every restricted address. Nor does a company’s published policy determine the outcome of a contested ownership claim. The circumstances authorizing the restriction, the identity of the holder, and any applicable governmental order remain relevant to its duration and eventual release.

Bitcoin and native Ether lack a centralized issuing company with a general administrative function capable of freezing selected address balances. Transactions confirmed under their respective blockchain rules cannot ordinarily be reversed by an issuer or exchange acting independently of the relevant network.

Recovery remains possible when investigators obtain lawful control over assets or the persons holding them. A court-authorized seizure may involve private keys recovered during an investigation, cryptocurrency held through a regulated intermediary, or cooperation from an exchange controlling the relevant account. These methods depend on gaining control over the assets rather than changing the underlying blockchain’s transaction history.

The technical characteristics of a blockchain can also affect the available intervention. Assets transferred through layer-2 networks may be subject to governance arrangements and emergency powers that differ from those operating on the underlying blockchain. The Binance incident produced a significant example of these differences on Arbitrum One.

On October 30, 2026, the Arbitrum Security Council announced an emergency intervention involving 8,425 ETH and approximately 74.56 million ARB associated with an address identified as connected to the suspected Binance exploit. The Council reported that the assets had been transferred into a designated address where they would remain frozen pending further governance action (Arbitrum Security Council, Security Council Emergency Action, 30 October 2026).

The intervention relied on the network’s upgrade mechanisms. According to the Council’s technical account, an emergency action temporarily modified the Arbitrum Inbox contract on Ethereum, enabling specially constructed cross-chain transactions to transfer the affected assets. The contract was subsequently restored to its previous implementation. Arbitrum stated that further movement of the secured assets would require an ArbitrumDAO governance vote.

This was different from the freezes imposed by Tether and Circle. Rather than exercising administrative authority as a token issuer, Arbitrum’s Security Council used emergency powers associated with the operation and governance of the layer-2 network. The intervention demonstrates that some blockchain governance structures possess technical capabilities to restrict or relocate assets even when the underlying cryptocurrency lacks a conventional central issuer.

The distinction has important legal consequences. Network governance rules may authorize an emergency intervention within a protocol’s institutional arrangements, but they do not independently resolve the applicable property rights, the jurisdiction of national courts, or the legal entitlement of competing claimants. Technical authority under a governance mechanism must be distinguished from a legally enforceable right to confiscate or distribute the affected assets.

The Arbitrum intervention also cannot be generalized to Bitcoin, Ethereum mainnet, or every layer-2 network. Their technical architectures and governance arrangements differ. A mechanism available within Arbitrum One does not establish a universal power to reverse cryptocurrency transactions across independent blockchains.

The Binance investigation consequently illustrates several distinct recovery methods. Stablecoin issuers may immobilize supported tokens, exchanges and custodians may restrict assets within their control, and certain network governance bodies may exercise defined emergency powers. Compulsory recovery and final restitution nevertheless remain subject to applicable legal authority and the rights of those claiming the property.

A suspected cryptocurrency theft can involve several legal systems simultaneously. The conduct may originate in one jurisdiction, affect accounts administered elsewhere, and involve assets issued by companies incorporated or regulated in different countries. Customers may also reside in states with separate rules concerning financial services, criminal offenses, and property rights.

The principles of jurisdiction in international law distinguish a state’s authority to prescribe laws, adjudicate legal disputes, and enforce compulsory measures. Territorial conduct, nationality, corporate relationships, and other recognized connections may support different forms of jurisdiction. Establishing one connection does not conclusively resolve the others.

Jurisdiction over a digital asset also requires attention to the persons and institutions controlling it. Corporate incorporation, contractual governing law, regulated custody, and the location of relevant operations may point toward different legal systems. No universally accepted rule makes the location of blockchain infrastructure decisive for every proprietary or enforcement dispute.

Binance announced in December 2025 that its global platform would transition to an Abu Dhabi Global Market regulatory structure. The arrangement became effective on January 5, 2026, with three entities operating under the supervision of the Financial Services Regulatory Authority: Nest Exchange Limited, Nest Clearing and Custody Limited, and Nest Trading Limited (Binance, December 8, 2025; Binance, January 5, 2026).

The entities perform different functions. Nest Exchange Limited provides regulated exchange-related services, Nest Clearing and Custody Limited undertakes clearing and custody activities, and Nest Trading Limited provides designated trading and related services outside the principal exchange arrangements. Their distinct roles are relevant when identifying the legal entity responsible for a particular transaction or custodial relationship.

Under Binance’s published transition arrangements, Nest Clearing and Custody Limited ordinarily provides custody of user digital assets. Certain exceptions were retained, including specified assets frozen pursuant to earlier official orders and assets associated with particular restricted Canadian customer accounts. The company also described the transfer of existing contractual rights and obligations to the relevant regulated entities.

These arrangements establish an identifiable regulatory and contractual structure. They do not establish which entity legally owned the wallets implicated on October 29, whether those wallets held customer or proprietary assets, or which entity exercised operational control over the affected signing credentials.

The distinction could become decisive in civil litigation or regulatory proceedings. A claim involving an exchange’s proprietary treasury may be legally different from a claim concerning assets held for customers by a regulated custodian. Abu Dhabi supervision creates substantial jurisdictional connections, but it does not exclude legitimate foreign investigations or establish exclusive jurisdiction over every affected claimant.

Tether International Limited redomiciled from the British Virgin Islands to El Salvador and became Tether International, S.A. de C.V. The company’s published token terms identify the corporate transition and the relevant contractual arrangements (Tether, Token Terms of Sale and Service, February 26, 2026).

Tether’s terms nevertheless designate British Virgin Islands law as the governing law of specified contractual relationships. The terms also contain dispute-resolution provisions governing disagreements arising from use of the company’s services. These provisions create legally significant connections with the British Virgin Islands despite Tether’s Salvadoran incorporation.

Corporate domicile and contractual governing law perform different functions. Salvadoran law may govern matters arising from the company’s corporate and regulatory status, while the selected BVI law may apply to covered contractual disputes. Neither connection necessarily controls a criminal proceeding brought in another jurisdiction.

A foreign investigator seeking Tether’s cooperation must also consider the legal character of the requested action. Voluntary assistance under applicable compliance policies differs from compulsory production of records or seizure pursuant to a legally binding order. Foreign decisions may require recognition, local legal procedures, or cooperation between authorities before enforcement can occur.

Proprietary disputes concerning USDT introduce another level of analysis. The law governing a contractual redemption right may differ from the law applied to a contested ownership claim over tokens held outside Tether’s direct custody. The applicable rules depend on the claim, the parties, and the forum considering the dispute.

Circle’s international arrangements distinguish its American issuer, Circle Internet Financial, LLC, from Circle Internet Financial Europe SAS. Circle’s published terms identify a dual-issuer arrangement for USDC, with separate documentation governing holders and services in the European Economic Area.

The French entity is authorized as an electronic money institution by the Autorité de contrôle prudentiel et de résolution. It is also recorded by the Autorité des marchés financiers as authorized to provide specified crypto-asset services under the European Markets in Crypto-Assets Regulation, Regulation (EU) 2023/1114. The AMF’s official register records the authorization date as April 23, 2026, while Circle’s own licensing page gives April 24, 2026. The relevant authorization was established in April 2026.

These arrangements are relevant because European rules governing electronic money tokens and regulated service providers differ from the contractual and regulatory provisions applicable to Circle’s American operations. Circle’s European documentation addresses issuance, custody, transfers, and redemption under the applicable MiCA and French regulatory requirements.

For holders outside the EEA, Circle’s October 15, 2026, USDC Terms generally designate Delaware law and applicable U.S. federal law. However, Section 34 establishes special provisions for Singapore customers. Those customers contract with Circle Internet Singapore Pte. Ltd., and the Singapore-specific version of Section 31 designates Singapore law. The applicable contractual counterparty and governing law consequently depend in part on the holder’s jurisdiction and the relevant terms (Circle, USDC Terms, October 15, 2026).

The distinctions among the American, European, and Singaporean arrangements affect the identification of contractual obligations, redemption rights, and competent authorities. They do not provide a universal answer to every dispute involving USDC or establish that a particular issuer’s domicile determines ownership of tokens held elsewhere.

The United States also enacted the Guiding and Establishing National Innovation for U.S. Stablecoins Act, commonly called the GENIUS Act. On October 21, 2026, the Office of the Comptroller of the Currency announced final implementing regulations and confirmed January 18, 2027, as the effective date of the legislation and its rule (OCC, Bulletin 2026-50, October 21, 2026).

The reported Binance incident occurred before that effective date. The GENIUS Act’s future requirements cannot be treated as the operative statutory basis for Circle’s October 29 intervention. Any compulsory legal authority exercised at that time must be assessed under the laws and orders applicable when the action occurred.

Several countries may possess legitimate grounds to investigate aspects of the same suspected theft. Territorial conduct, involvement of nationals, affected operations, and other recognized jurisdictional connections can support overlapping criminal jurisdiction, subject to applicable national and international rules.

Civil proceedings raise different questions. A claimant may seek relief against the company responsible for custody, against an alleged wrongdoer, or against an intermediary possessing identifiable assets. The forum hearing the claim may need to determine contractual obligations, proprietary interests, and the applicable law through its own conflict-of-laws rules.

Cryptocurrency’s distributed accounting structure complicates attempts to identify a single territorial location for a token. Copies of blockchain records may exist in many countries, while effective control may depend on signing credentials held elsewhere. Neither the location of an individual network node nor the headquarters of one service provider automatically fixes the legal location of the asset.

The distinction between adjudication and enforcement remains decisive. A court may establish jurisdiction over a defendant or dispute yet lack the practical authority to compel an unrelated foreign institution to act. Recognition of foreign judgments, local enforcement proceedings, or official cooperation may be necessary to make the decision effective.

These limits help explain why an investigation involving Binance, Tether, and Circle may require several legal processes. A jurisdiction competent to investigate the suspected offense may not be the same jurisdiction best placed to compel production of records, enforce a freeze, or determine a particular customer’s ownership rights.

The international legal dimension becomes particularly significant when investigators require evidence or assistance outside their national jurisdiction. Blockchain transactions may be publicly visible, but identifying the individuals who control addresses often requires information held by exchanges, financial institutions, communications providers, and other intermediaries.

International cooperation can help authorities obtain account records, preserve electronic evidence, identify suspects, and locate assets connected to criminal activity. The evolution of international law in cyberspace has involved applying established jurisdictional principles to digital conduct while developing specialized mechanisms for investigating offenses that cross national boundaries.

The distinction between international cooperation and national enforcement remains essential. A treaty may establish obligations to assist foreign investigators without authorizing those investigators to exercise unrestricted coercive powers abroad. The legal authority needed to preserve evidence may also differ from that required to seize cryptocurrency or transfer property to a claimant.

The Convention on Cybercrime, adopted in Budapest on November 23, 2001, provides an established treaty framework for addressing specified computer-related offenses. It entered into force on July 1, 2004, and contains provisions concerning substantive criminal law, investigative powers, jurisdiction, and international cooperation (Council of Europe, 2001).

Article 22 addresses criminal jurisdiction, including specified offenses committed within a state’s territory. Articles 16 and 29 concern the expedited preservation of stored computer data through domestic and international procedures. Article 31 provides for mutual assistance concerning access to stored data, while Article 35 establishes a network of contact points available continuously to support urgent investigations.

These provisions could be relevant to a suspected cryptocurrency theft requiring information about account access, authorization records, communications, or electronic activity held by foreign service providers. Preservation may protect information against deletion while investigators pursue the legal procedures necessary to obtain disclosure.

The Convention nevertheless distinguishes electronic evidence from property. Article 29 concerns preservation of stored computer data; it does not create a general international power to freeze cryptocurrency balances. Seizure of digital assets and determination of their ownership require a separate legal basis under applicable law.

The treaty’s operation also depends on participation, national implementation, and the conditions governing particular forms of assistance. Authorities cannot assume that every relevant country is bound by the same obligations or that treaty participation permits unrestricted cross-border searches. The October 30 public announcements did not establish that a particular Budapest Convention request had been issued in connection with the Binance investigation.

Mutual legal assistance provides formal channels through which national authorities may request evidence or investigative measures from another state. Depending on the applicable treaties and domestic legislation, assistance may involve financial records, testimony, identification of suspects, searches, or measures concerning property suspected to represent criminal proceeds.

The United Nations Convention against Transnational Organized Crime provides additional mechanisms where its conditions are satisfied. Article 13 addresses international cooperation concerning confiscation. Article 14 governs the disposal of confiscated proceeds or property and includes provisions concerning compensation of victims and return to legitimate owners (United Nations, 2000).

Article 14(2) requires states parties, when acting on a qualifying request under Article 13, to give priority consideration to returning confiscated property to the requesting state so that it can compensate victims or restore property to legitimate owners. This obligation operates within the limits of domestic law and depends on the conditions specified in the Convention. It does not create an unconditional right to receive the confiscated assets.

The Convention’s applicability must also be established. Article 3 covers specified offenses and serious crimes meeting the relevant transnational and organized-criminal-group requirements, subject to the Convention’s provisions. A suspected cryptocurrency theft does not fall within its scope merely because the assets were transferred across national borders.

INTERPOL provides a complementary police-cooperation mechanism. Its Silver Notice system, introduced in January 2025, enables participating authorities to seek information concerning assets associated with criminal activity. Such notices can assist in locating and tracing property, but they do not independently authorize confiscation or compel a foreign court to recognize a recovery claim (INTERPOL, 2025).

Two newer instruments had not entered into force by October 30, 2026: the Second Additional Protocol to the Budapest Convention on enhanced cooperation and electronic evidence, and the United Nations Convention against Cybercrime adopted in December 2024. Their prospective provisions cannot be treated as operative treaty obligations governing the reported Binance incident.

A private stablecoin freeze may preserve assets while investigators establish their origin and identify possible claimants. The subsequent legal process depends on the suspected offense, the location and control of the property, and the powers available to competent authorities. A restriction imposed by an issuer does not automatically become a judicial seizure.

Criminal investigations may lead to temporary restraint, court-authorized seizure, civil forfeiture, or confiscation following criminal proceedings. These mechanisms have different evidentiary requirements and procedural consequences. Persons asserting ownership may be entitled to notice, an opportunity to contest the government’s position, or other protections under the governing legal system.

A further distinction concerns adjudicatory jurisdiction in international law. A court may have authority to determine a dispute without possessing an independent power to enforce its decision against foreign persons or property. Cryptocurrency recovery may consequently require several proceedings before a judgment can produce an effective transfer.

United States federal law provides mechanisms for pursuing cryptocurrency connected to qualifying criminal conduct. Under 18 U.S.C. § 981, specified property may be subject to civil forfeiture, including property associated with certain fraud and money-laundering offenses. The government must establish that the relevant statutory conditions are satisfied.

Section 983 governs important procedural aspects of civil forfeiture. Under § 983(c)(1), the government bears the burden of establishing forfeitability by a preponderance of the evidence. Section 983(c)(3) requires a substantial connection between the property and the offense when forfeiture is based on the property’s use to commit, facilitate, or involvement in criminal conduct.

Section 983(d) also protects qualifying innocent owners. A claimant asserting that defense must establish the relevant ownership interest and satisfy the applicable statutory requirements. The availability of such protection illustrates why cryptocurrency found in a suspicious address cannot automatically be treated as property belonging to the offender.

Investigators may initially seek a seizure warrant under applicable federal procedures. Where cryptocurrency is held by a cooperative issuer or custodian, execution may involve transferring the identified assets into a government-controlled wallet. This establishes legally authorized control but does not necessarily complete the forfeiture process.

Restitution introduces additional legal requirements. Criminal restitution orders, civil forfeiture proceedings, and administrative mechanisms for remission or restoration operate under different statutory provisions. The availability of relief to a particular claimant depends on the governing procedure and the nature of the claimant’s legally recognized loss.

Even successful forfeiture does not automatically determine that all recovered cryptocurrency must be transferred to Binance. A court or competent authority may need to consider competing interests, evidence of ownership, prior compensation, and the legal relationship between the suspected offense and the assets.

Civil proceedings may offer another method of protecting cryptocurrency while ownership claims are determined. English law provides an important example in AA v Persons Unknown [2019] EWHC 3556 (Comm), a case involving Bitcoin associated with a ransomware payment made following an attack on a Canadian insurance company.

The applicant, an insurer, sought interim proprietary relief against unidentified persons and entities associated with the cryptocurrency. The Commercial Court considered whether Bitcoin could qualify as property capable of supporting a proprietary injunction. The question was significant because cryptocurrency did not fit comfortably within the traditional categories of tangible property and enforceable choses in action.

At paragraphs 59–63, Bryan J accepted that Bitcoin could constitute property for purposes of the interim application. The judgment drew upon the criteria associated with National Provincial Bank Ltd v Ainsworth [1965] AC 1175 and contemporary legal analysis of crypto-assets. The court determined that the requirements for interim proprietary relief were satisfied, without finally resolving every issue concerning ownership or liability.

The Property (Digital Assets etc) Act 2025 subsequently addressed an important classification issue. Section 1 provides that a digital or electronic thing is not prevented from being the object of personal property rights merely because it is neither a thing in possession nor a thing in action. The Act received Royal Assent and entered into force on December 2, 2025, extending to England and Wales and Northern Ireland.

The legislation removes a particular obstacle to recognizing property rights but does not establish that every digital object necessarily constitutes property. It also does not provide a comprehensive mechanism for international cryptocurrency restitution. The existence and enforcement of particular rights remain governed by the applicable legal principles.

A proprietary injunction may preserve identifiable assets claimed by the applicant, while a freezing injunction may restrain dealings with assets more generally to protect the effectiveness of proceedings. The two remedies serve different legal purposes. Their availability, territorial reach, and enforceability against foreign entities depend on the circumstances of the case and the court’s jurisdiction.

Determining legal entitlement may prove more difficult than identifying cryptocurrency movements. Exchange-operated wallets can contain assets associated with numerous customers, while internal records allocate balances in ways that are not visible on the blockchain. The person controlling a private key does not necessarily possess the entire beneficial interest in the corresponding cryptocurrency.

The October 29 incident has made this distinction particularly significant. A review of Binance’s October 1 proof-of-reserves data by CoinDesk identified wallets associated with the suspected unauthorized transfers among addresses previously disclosed as backing customer balances. The findings indicate a connection between the affected wallets and customer reserves, although the earlier snapshot cannot independently establish the exchange’s financial position after the incident (CoinDesk, 29 October 2026).

Binance has committed to covering the losses using SAFU and company resources. That commitment may protect customers from bearing the financial consequences of the incident, but it does not determine the legal ownership of individual frozen tokens. The recovery process must still account for the applicable custody arrangements, proprietary rights, contractual obligations, and any compensation already provided.

A suspected loss involving Binance’s proprietary cryptocurrency raises different legal questions from one involving customer assets held in custody. In the first situation, the exchange may assert its own property rights. In the second, customers may possess proprietary interests, contractual rights, or other legally recognized claims against the relevant service provider.

Binance’s January 2026 regulatory transition placed ordinary custody functions for user digital assets principally with Nest Clearing and Custody Limited, subject to published exceptions. Its Terms of Use, effective May 7, 2026, state that Nest Clearing and Custody Limited holds assets for customers in its capacity as trustee, subject to the terms of the agreement. That contractual arrangement is relevant to the legal characterization of qualifying custodial assets, but it does not establish the ownership of every wallet implicated in the incident.

The October 29 incident brought the relationship between exchange reserves and customer balances into sharper focus. CoinDesk reported that a wallet labeled Binance 14, associated with the suspicious transfers, appeared in Binance’s October 1 proof-of-reserves records. At that earlier snapshot, the wallet reportedly held approximately 1.26 billion USDT and 89,475 ETH, together with other digital assets (CoinDesk, Binance Hack Drained Wallets Backing Customer Assets, 29 October 2026).

The same analysis suggested that the loss of approximately 204,500 ETH across affected wallets could temporarily reduce the exchange’s Ether reserve coverage from approximately 100% to around 94%, assuming no replacement assets or other changes. That figure was a conditional estimate based on the October 1 reserve snapshot, not a confirmed measurement of Binance’s financial position after the incident.

Proof-of-reserves reporting and legally enforceable customer entitlements perform different functions. A disclosed wallet may demonstrate the existence of assets included in an exchange’s reserve calculations without conclusively establishing which customers possess proprietary rights over its contents. The snapshot date, asset allocation, customer liabilities, and subsequent transactions all affect the interpretation.

Binance’s October 30 announcement stated that user funds were safe and that all losses would be covered. The exchange also promised to publish an updated proof-of-reserves report after completing remediation. The announcement did not establish that all affected reserves had already been replenished or that every possible customer claim had been finally determined (Binance, Security Incident Update, 30 October 2026).

Customer compensation may create further legal consequences. If Binance reimburses a customer before the relevant cryptocurrency is recovered, the resulting rights may depend on assignment, subrogation, or other mechanisms under the governing contract or law. Those arrangements can affect which party may subsequently claim recovered assets.

Their application cannot be presumed. Payment of compensation does not invariably transfer ownership of a corresponding cryptocurrency asset, and different legal systems may characterize the resulting claims differently. Any final distribution would need to account for compensation already provided while avoiding duplicate recovery of the same economic loss.

The available information establishes a relationship between the affected wallets and customer reserve arrangements, alongside Binance’s express compensation commitment. It does not conclusively determine the ownership of every frozen asset or establish that Binance, its customers, or another claimant possesses an exclusive right to receive the entire amount.

Binance established the Secure Asset Fund for Users, known as SAFU, as a reserve intended to protect customers against specified losses. The fund operates separately from cryptocurrency recovered through criminal investigations or civil proceedings, and access to its resources remains subject to Binance’s published arrangements.

In January 2026, the fund was described as holding approximately $1 billion in USDC. Binance subsequently changed its composition. On January 30, the company announced plans to convert the reserve into Bitcoin, and on February 12 it reported completing the conversion. The fund then held approximately 15,000 BTC, valued at about $1 billion at the time (Binance, February 12, 2026).

This change exposed the reserve’s dollar value to Bitcoin price movements. Binance stated that it intended to replenish the fund toward its $1 billion target if its value fell below $800 million because of market fluctuations. Its published SAFU arrangements also address the relationship between the fund and Binance’s regulatory capital obligations in Abu Dhabi.

The Binance incident substantially exceeds the approximate value of that reserve at the time of its conversion. With a reported impact of approximately $6.3 billion, SAFU alone cannot be presumed sufficient to meet every potential loss, even if its assets were available for that purpose.

Binance addressed this issue directly in its October 30 statement. The company committed to covering all losses through a combination of SAFU and its own funds. The commitment extends beyond the previously described reserve and indicates that Binance intends to assume financial responsibility for the incident rather than limiting compensation to SAFU’s value (Binance, Security Incident Update, 30 October 2026).

The statement is significant, but its legal and financial consequences require distinction. A public undertaking to cover losses does not establish that compensation has already been paid, identify the precise source of each payment, or determine how the affected assets will be allocated among customers and corporate accounts. Nor does it independently establish the amount of unrestricted company resources available for immediate distribution.

Binance’s published SAFU conditions also retain relevance. They identify specified categories of eligible loss, describe the procedure for submitting requests, and reserve discretion concerning the fund’s administration. The October 30 commitment must be considered alongside those conditions, rather than assuming that the general SAFU rules alone define the entirety of Binance’s responsibility for this particular incident.

The distinction between financial compensation and cryptocurrency restitution remains important. Binance may honor customer balances or compensate qualifying losses while law-enforcement authorities continue attempting to recover stolen assets. If cryptocurrency is later returned, questions may arise concerning the rights of the exchange, previously compensated customers, and other legally recognized claimants.

As of October 30, Binance had expressly promised to cover the losses and had identified SAFU and company resources as the intended sources. The available public announcements did not establish that all compensation had been distributed, that the full financial impact had been conclusively determined, or that the frozen cryptocurrency had been legally restored to its rightful owners.

Earlier cryptocurrency investigations demonstrate that digital assets can be traced, placed under lawful governmental control, subjected to forfeiture proceedings, and returned to persons with recognized claims. The processes have been applied to stablecoins and native cryptocurrencies, although the technical means of obtaining control may differ.

The relevant precedents also expose the limitations of recovery. Identification of suspicious transfers does not necessarily establish ownership, and seizure of cryptocurrency does not complete a forfeiture proceeding. Even after a government obtains legal title, returning the economic value to affected persons may require further administrative or judicial action.

United States proceedings involving Tether and the Bitfinex theft are useful because they document different stages of this process. Their significance lies in the specific legal measures employed, rather than in any assumption that the Binance investigation will produce the same outcome.

On February 28, 2025, the U.S. Attorney’s Office for the Northern District of Ohio announced a civil forfeiture complaint concerning 8,207,578 USDT. Investigators alleged that the cryptocurrency was associated with an investment fraud scheme affecting victims in several American states (U.S. Department of Justice, Northern District of Ohio, February 28, 2025).

According to the Department of Justice, investigators traced cryptocurrency to three addresses and executed a federal seizure warrant in November 2024. Tether assisted by transferring the identified tokens to a law-enforcement-controlled wallet. The cooperation enabled authorities to secure the assets before the forfeiture litigation had been completed.

The government filed its complaint on February 27, 2025, seeking forfeiture of the cryptocurrency. At that stage, the allegations remained subject to proof, and the Department stated that it intended to seek the return of stolen funds to victims if the proceedings succeeded. The announcement did not establish a completed forfeiture judgment or restitution payment.

A later announcement from the District of Maine illustrates a different procedural stage. On March 13, 2026, the Department of Justice reported that approximately $470,735 would be returned to two victims of a cryptocurrency investment scheme. The FBI had seized 470,773 USDT linked to the victims’ transfers, and a federal court had subsequently ordered forfeiture of the property (U.S. Department of Justice, District of Maine, March 13, 2026).

The Maine announcement identified a judicial forfeiture order and an intended distribution to victims. It did not independently document the date on which each recipient actually received payment. That distinction is important when evaluating official claims of successful asset recovery.

Both proceedings demonstrate the potential effectiveness of cooperation between law-enforcement authorities and a stablecoin issuer. They also demonstrate why a freeze or seizure should not be described as completed restitution. The legal process may continue after investigators have obtained effective control over the cryptocurrency.

The 2016 Bitfinex theft involved approximately 119,754 Bitcoin transferred through more than 2,000 unauthorized transactions. In February 2022, the U.S. Department of Justice announced the seizure of cryptocurrency valued at approximately $3.6 billion at the time of recovery, following an investigation into the laundering of the stolen assets (U.S. Department of Justice, February 8, 2022).

Ilya Lichtenstein and Heather Morgan pleaded guilty in August 2023 to offenses arising from the laundering conspiracy. Lichtenstein admitted responsibility for the original unauthorized access to Bitfinex, while both defendants acknowledged participation in laundering activity. The Department of Justice subsequently announced Lichtenstein’s sentencing in November 2024.

The investigation demonstrated that substantial quantities of stolen Bitcoin could be located years after the original theft. Authorities obtained control of assets through investigative procedures rather than through an issuer capable of blocking Bitcoin transactions. The operation illustrates a recovery method unavailable through ordinary centralized token-freezing mechanisms.

Questions concerning victim entitlement remained legally distinct. In November 2024, the Department of Justice established a procedure for potentially affected persons to submit information about the consequences of the Bitfinex theft. The government also stated its position that there were no qualifying victims of the offenses of conviction for purposes of the Crime Victims’ Rights Act (U.S. Department of Justice, District of Columbia, November 7, 2024).

That position concerned the statutory treatment of the offenses in the criminal proceedings. It did not mean that the original theft caused no financial losses or conclusively resolve every civil or proprietary claim connected to the stolen cryptocurrency.

The distinction is relevant to Binance. A court may determine criminal responsibility and order forfeiture without simultaneously resolving all possible claims arising from the exchange’s customer relationships. The identity of the original exchange, the existence of affected accountholders, and the legal consequences of prior compensation may require separate consideration.

The historical cases establish that cryptocurrency recovery is possible, sometimes on a substantial scale. They do not provide a legal presumption that every asset frozen during the October 29 investigation will be returned or identify the persons entitled to receive it.

The investigation acquired a significant international-law dimension on October 30, when blockchain intelligence companies linked the suspected Binance theft to North Korean cyber operations. TRM Labs attributed the attack to TraderTraitor, a group previously identified by the FBI in connection with the February 2025 Bybit theft. Chainalysis also reported an assessment pointing toward North Korean involvement (Reuters, 30 October 2026).

These findings make state attribution more directly relevant than it appeared during the initial investigation. Nevertheless, a private cybersecurity company’s attribution assessment must be distinguished from an official determination by a state, a judicial finding, or proof that the legal conditions for international state responsibility have been satisfied.

The law of state responsibility establishes the circumstances in which conduct can be attributed to a state and constitute a breach of an international obligation. Even if the suspected perpetrators were conclusively identified, the international legal consequences would depend on their relationship with the state, the nature of the conduct, and the primary international obligations applicable to it.

On February 26, 2025, the Federal Bureau of Investigation publicly attributed the theft of approximately $1.5 billion in cryptocurrency from Bybit to North Korea. The FBI identified the operation as TraderTraitor and described efforts to move stolen assets through numerous blockchain addresses and networks (FBI, North Korea Responsible for $1.5 Billion Bybit Hack, February 26, 2025).

The United States Department of Justice also announced two civil forfeiture complaints in November 2025 seeking more than $15 million in USDT allegedly associated with North Korean APT38 operations. The proceedings concerned cryptocurrency seized in March 2025 and allegedly connected to thefts from several virtual-asset platforms in 2023 (U.S. Department of Justice, November 14, 2025).

The October 2026 Binance investigation has now produced a further attribution assessment. TRM Labs reported that the suspected attacker transferred approximately $6.36 billion from Binance-associated wallets across ten blockchain networks. The company attributed the operation to TraderTraitor with high confidence, citing blockchain activity and other intelligence it considered consistent with earlier North Korean operations (TRM Labs, North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History, 29 October 2026).

The reported indicators included preparatory activity involving Tornado Cash, the staging of malicious transaction mechanisms before the large transfers, and the use of signed authorizations to move substantial assets within a short period. TRM compared those characteristics with earlier incidents linked to North Korea, including the Bybit theft.

Chainalysis also assessed that North Korean involvement was likely. The convergence of the private-sector assessments strengthens the investigative case, but the detailed intelligence underlying every aspect of the attribution has not been made publicly available for independent examination.

The distinction between technical identification and legal attribution remains essential. Blockchain records can establish transactions, addresses, timing, and relationships among wallets. Additional intelligence may support identification of the individuals or organizations controlling those addresses. Neither category of evidence automatically determines whether their conduct is legally attributable to a state.

The International Law Commission’s 2001 Articles on Responsibility of States for Internationally Wrongful Acts provide the relevant legal framework. Article 4 concerns conduct of state organs, while Article 8 addresses conduct by persons or groups acting on a state’s instructions or under its direction or control (ILC, 2001).

The Articles are not themselves a binding multilateral treaty. They constitute an influential codification and development of international law, with significant provisions reflecting customary international law. Their application depends on the particular rule involved and the evidence supporting the alleged attribution.

Article 2 identifies two elements of an internationally wrongful act: conduct attributable to a state and a breach of an international obligation binding on that state. Establishing that a hacking group has links to North Korean authorities would not, without further legal analysis, establish that every operation conducted by that group is attributable to the DPRK under the applicable rules.

The second element also requires identifying a relevant international obligation. The law of state responsibility does not independently prohibit cryptocurrency theft or create a general international criminal offense covering every unauthorized transfer of digital assets. Any claim of an internationally wrongful act would need to identify the applicable treaty obligation or customary international rule allegedly breached.

If the required elements were established, further questions could arise concerning cessation, reparation, and the invocation of responsibility by an entitled state. These consequences would remain separate from the criminal prosecution of individual perpetrators and the private-law claims of Binance or its customers.

The October 30 attribution assessments represent an important development in the investigation. They provide a substantial basis for examining possible state involvement, but they do not independently establish a judicial finding of responsibility or determine the legal ownership of the affected cryptocurrency.

The Democratic People’s Republic of Korea is subject to sanctions imposed through United Nations Security Council Resolution 1718 (2006) and subsequent resolutions. The regime includes restrictions involving designated persons and entities, prohibited financial activities, and assets connected with specified programs or sanctions violations (United Nations Security Council, 2006).

The Security Council’s 1718 Committee oversees the relevant sanctions regime. Applicable asset-freezing measures require implementation by member states according to the terms of the relevant resolutions. National authorities consequently play a central role in determining which assets fall within the applicable restrictions and how those measures are enforced.

The United States maintains additional sanctions administered by the Office of Foreign Assets Control. American sanctions may prohibit transactions involving designated persons, entities, or property interests under U.S. law. These measures must be distinguished from obligations imposed directly through Security Council decisions, even where their objectives overlap.

The attribution of the Binance incident to TraderTraitor by blockchain intelligence companies makes sanctions analysis more relevant. If assets or persons involved in the suspected theft were shown to fall within an applicable designation or other sanctions prohibition, the restrictions could affect transfers, custody, redemption, and eventual recovery.

However, attribution to a North Korean-associated group does not automatically establish that every cryptocurrency address identified during the investigation is subject to a particular sanctions measure. The relevant legal basis, designated persons, ownership interests, and jurisdictional requirements must be established separately.

A sanctions freeze also differs from criminal confiscation. Blocking property generally restricts specified dealings with the assets but does not necessarily transfer their ownership to the government. A criminal forfeiture judgment or other lawful recovery mechanism may still be necessary before property can be distributed to victims.

The distinction is especially important for stablecoins. Tether or Circle may impose an address restriction through its contractual or compliance arrangements, while a government may separately require an asset freeze under applicable sanctions law. The legal justification and consequences of those actions are not necessarily identical.

Sanctions restrictions may also affect the execution of judicial recovery orders. Where property is subject to applicable blocking measures, transferring it may require a license, an exemption, or another legally authorized procedure. A court’s determination that a claimant possesses an ownership interest does not automatically eliminate independently applicable restrictions.

If the North Korean attribution were supported by sufficient evidence and relevant sanctions provisions applied, national authorities might need to coordinate criminal recovery, financial sanctions enforcement, and restitution procedures. These processes could involve different institutions exercising powers under different legal instruments.

The central limitation remains unchanged. International sanctions may restrict access to assets associated with prohibited conduct or designated persons, but they do not independently establish that Binance or any particular customer is entitled to receive the frozen cryptocurrency.

The October 29 Binance incident has developed into an unusually large test of cryptocurrency recovery across national borders. Binance now estimates the financial impact at approximately $6.3 billion and reports that around $3 billion in affected assets has been frozen. The investigation has also produced preliminary evidence concerning unauthorized access to internal systems and substantial, though not conclusive, private-sector attribution to North Korean cyber operations.

The recovery measures demonstrate the different forms of control available within cryptocurrency markets. Tether and Circle can immobilize specified stablecoins through issuer-administered mechanisms, while Arbitrum’s Security Council has demonstrated the capacity to secure assets through emergency network governance powers. These interventions may preserve property that would otherwise remain accessible to suspected offenders, but they do not independently determine legal ownership or authorize final restitution.

Binance’s commitment to cover all losses through SAFU and company resources introduces a separate form of financial protection. Compensation may limit the immediate consequences for customers even while investigators continue tracing and recovering cryptocurrency. The company’s undertaking does not eliminate the need to establish the affected assets, legally recognized claims, and rights arising from any subsequent recovery.

International law provides mechanisms for cooperation between states and establishes limits on their exercise of jurisdiction. Treaty-based assistance can support investigations and criminal asset recovery, while the rules of state responsibility and international sanctions may become applicable if their respective conditions are established. Final ownership determinations and compulsory restitution nevertheless remain principally dependent on applicable domestic law and competent authorities.

The decisive question is whether the assets already secured can be brought within legally enforceable recovery arrangements and ultimately restored to those entitled to receive them. As of October 30, 2026, substantial amounts had been immobilized and Binance had publicly undertaken to cover the losses, but neither development established that the frozen cryptocurrency had been judicially confiscated or that restitution had been completed.

European Parliament and Council of the European Union (2023) Regulation (EU) 2023/1114 of 31 May 2023 on Markets in Crypto-Assets, Official Journal of the European Union, L 150, 9 June, pp. 40–205. Available at: https://eur-lex.europa.eu/eli/reg/2023/1114/oj/eng (Accessed: 29 October 2026).

House of Lords (1965) National Provincial Bank Ltd v Ainsworth [1965] AC 1175.

International Law Commission (2001) ‘Draft Articles on Responsibility of States for Internationally Wrongful Acts, with Commentaries’, Report of the International Law Commission on the Work of Its Fifty-Third Session, UN Doc. A/56/10, Chapter IV.

Tether (2026) ‘Token Terms of Sale and Service’, updated 26 February [online]. Available at: https://tether.to/en/legal/ (Accessed: 29 October 2026).

United Nations Security Council (2006) Resolution 1718 (2006), adopted at the 5551st meeting, 14 October, UN Doc. S/RES/1718(2006). Available at: https://digitallibrary.un.org/record/584729 (Accessed: 29 October 2026).