After the Freeze: What Happens to Blacklisted Stablecoins?

At 21:01:35 UTC on October 29, the Ethereum USDT contract blacklisted an address holding approximately 971.1 million USDT.^[1] Three minutes and 24 seconds later, the Ethereum USDC contract blacklisted the same address, which held 823 million USDC.^[2]

In our reconstruction, a simulated outbound transfer succeeded immediately before each blacklist and reverted immediately afterward. The balances stayed at the address, and neither blacklist transaction burned tokens.

After the blacklist, a further 204.3 million USDT arrived. By the last block examined on November 3, the address held about 1.175 billion USDT and 823 million USDC, with both blacklist flags still active.

That sequence is worth following. It shows the balance at the moment of the freeze, what arrived afterward, how long the restriction has lasted, and whether anything has changed since. By the observation cutoff, the two balances had accumulated 9.413 billion nominal dollar-days under restriction, a measure of amount multiplied by time that is explained below.

What Binance Said, and What the Chain Shows

The transactions occurred during the security incident Binance reported on October 29. Binance said its hot wallets had been compromised at around 20:05 UTC, estimated losses at $6.3 billion across token assets, and reported approximately $3 billion frozen on-chain by October 30.^[3]

Etherscan labels the address “Binance Hot Wallet Exploiter 2,”^[4] a third-party attribution: Binance’s statement does not name the address, and the contract records do not show who controlled it.

The reconstruction covers the Ethereum USDC and USDT contracts at that address:

Observation, October 29, 2026	USDC	USDT
First relevant arrival at the address	20:41:23 UTC	20:24:23 UTC
Blacklist transaction	21:04:59 UTC	21:01:35 UTC
Balance at the blacklist block	823,000,000 USDC	971,149,299.483240 USDT
First arrival to blacklist	23 minutes 36 seconds	37 minutes 12 seconds

The balances sum to approximately $1.794 billion at nominal dollar parity, each measured at its own blacklist block, three minutes and 24 seconds apart.

The intervals depend on where the clock starts. USDC first reached this address at 20:41:23, but the transaction we treat as the main Ethereum drain occurred at 20:24:23.^[5] Starting the USDC clock there gives 40 minutes and 36 seconds. Neither clock shows when Circle learned of the incident, received a request, or submitted its transaction, so the intervals cannot be used to rank the issuers’ responses.

The USDT trail extends beyond the principal address. Approximately 1.671 billion USDT arrived before its blacklist, and the address sent 500 million and 200 million USDT to two other addresses earlier that evening; Tether blacklisted both at around 21:01. Our reconstruction did not establish their balances at that point or what happened to the funds afterward. ChainWard’s separate investigation reports that both had emptied before their own blacklists and follows some of the subsequent hops.^[6] We have not added its downstream findings to our one-address calculation, and we do not count the 700 million as recovered.

Frozen, but Still Receiving

The blacklist transactions changed what the address could do while leaving its balance, and each contract’s totalSupply, exactly where they were.

The two contracts impose different restrictions. Circle describes its blocklist as preventing an address from sending or receiving USDC.^[7] The Ethereum USDT blacklist in this case stopped the address from sending, but transfers into it still succeeded. Those inflows increased the restricted balance, although they do not show who sent the funds or why.

Bitquery’s August 2026 audit had already recorded USDT arriving at addresses after they were frozen, on both Ethereum and Tron.^[8] What this case adds is a dated reconstruction of the balance held under restriction and how long it stayed there, with the scope of each contract stated.

When an issuer says it has frozen funds, it is describing what an address can no longer do. Whether the money is ever recovered depends on what happens next, and so far the records show no return to Binance, nothing about who legally owns the tokens, and no resolution of the case.

Until one of the issuers unfreezes the address, destroys the balance, or intervenes in some other way, the tokens will stay where they are.

Measuring a Freeze Over Time

One way to measure this combines the amount held under an observable restriction with the time it stays there.

For token contract $i$ and address $a$, define the restricted balance at time $t$ as:

$$F_{i,a}(t)=b_{i,a}(t)\mathbf{1}\{a\text{ is blacklisted under contract }i\text{ at }t\}$$

Here, $b_{i,a}(t)$ is the address’s token balance. The indicator equals one while the relevant blacklist restriction is active and zero otherwise. The restriction would need to be defined and checked for each contract.

Over a stated observation window, a candidate measure of restricted balance exposure would be:

$$E_i(t_0,t_1)={\int }_{t_0}^{t_1}\sum _{a\in A_i}{F}_{i,a}(t)dt$$

The set $A_i$ contains the distinct addresses covered by the study for contract $i$. With time measured in days, the result is in token-days. For a dollar-denominated token valued at nominal parity, it can also be expressed as nominal dollar-days.

For example, a constant balance of 100 million tokens restricted for three days produces 300 million token-days. A balance of 300 million restricted for one day produces the same figure.

Applying the formula to the one address examined here, using each blacklist block as the beginning of its token’s observation window, gives the following through November 3 at 14:09:35 UTC:

Contract	Restricted balance exposure
Ethereum USDT	5.535 billion token-days
Ethereum USDC	3.878 billion token-days
Combined, at nominal dollar parity	9.413 billion nominal dollar-days

The calculation treats the balance as constant between transfer blocks and changes it at the timestamp of each transfer block, so USDT’s post-blacklist inflows add exposure only from their arrival times. Both restrictions were still active at the end of the window, so the figure will keep growing for as long as the balances stay restricted. It does not mean that $9.413 billion was frozen, lost, or recovered.

The measure tells you how much was held under a given restriction and for how long. It says nothing about losses prevented or funds recovered, or about how well an issuer handled the case, and a larger number could just as easily reflect a bigger starting balance, a longer freeze or, as here, later inflows.

What Happens Next

A broader study could reconstruct blacklist additions and removals, track balances between them, and record outcomes where public evidence supports them. Contract versions and networks need separate treatment because their administrative controls differ, and each figure needs a stated coverage: one address, one incident, or a whole contract’s blacklist.

A restriction still in force contributes exposure only up to the observation cutoff, which leaves its final duration and outcome open. Transfers between covered addresses need consistent timing so that the same units are not counted twice, and burns, reissuance, and reported returns should be recorded separately instead of being combined into one recovery category. Binance reported on November 2 that it had replenished about 95% of affected assets using its own funds,^[9] but replenishing customer balances does not show that these particular blacklisted tokens were returned or released.

On October 29 the outbound transfers stopped working, the balances stayed where they were, and more USDT kept arriving. Following this address until the case is resolved would show what an on-chain freeze achieves and which parts of the outcome need evidence from outside the blockchain.

Method and Scope

This article uses our reconstruction of the Ethereum USDC and USDT contracts at address 0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c. It draws on raw transfer and blacklist logs, transaction receipts, block timestamps, historical balanceOf, totalSupply and blacklist-state calls, and historical transfer simulations. The reconstruction records checks of material receipts, block headers and contract reads against two independent public Ethereum endpoints; the historical log search used one endpoint, with material receipts checked on both.

The last observed block was 26334779, at 14:09:35 UTC on November 3, 2026. The analysis covers two tokens at one principal address, with limited observations about two additional addresses. It does not reconstruct all assets affected by Binance’s reported incident. The amount-time calculation uses the event timeline, with balance changes at block timestamps and no interpolation. The full timeline, data and code are on the companion page.