Brooke Watson, Dynamis LLP
About $3 billion of the stolen Binance funds has reportedly been frozen. But the money has already moved through market makers, lending protocols and other wallets. Some third parties may now find themselves caught in the transaction trail despite having no knowledge of the theft. If you are one of them, the clock may already be running.
A few days ago I posted a piece on what to do if you are falsely accused in a crypto scam. The point was simple: being caught in the net is not the same as being guilty. When someone draws a line on the blockchain from a scam to you, that line shows how money moved. It does not show what you knew.
Two days later, that point got its biggest test yet. On the evening of October 29, someone emptied Binance's hot wallets on ten blockchains in under four hours. Binance estimates the impact at about $6.3 billion, and TRM Labs puts it at $6.36 billion. If the current estimates hold, this would be the largest cryptocurrency theft on record.
The stolen money moved fast and touched a lot of wallets, and the freezes have already started. Some of the people now holding frozen funds did nothing wrong. They are about to learn that being linked to stolen money is a legal problem even when you are innocent.
Most coverage has focused on how the theft happened and who did it. I spent twelve years as a federal prosecutor in Miami, on the government's side of exactly these cases. This post is about what happens next to everyone else.
What happened, and what we actually know
The facts are still coming in. Here is what is reported as of October 30.
The theft. Starting around 20:05 UTC on October 29, funds left Binance hot wallets on ten networks, according to TRM Labs. On Ethereum alone, one wallet lost about $2.8 billion in a single sweep.
The method. On Ethereum, the attacker submitted a transaction containing fifty pre-signed EIP-7702 authorizations, each prepared for a different transaction nonce. One matched the hot wallet's live nonce, which let the attacker delegate the wallet's execution to a sweeper contract it controlled. That contract emptied the wallet. Binance says its preliminary investigation points to a compromised DevOps engineer's laptop. It has since found additional points of breach, and it says it has seen no evidence of a wallet private-key leak (The Hacker News).
Who did it. Here it matters what is confirmed and what is not. Binance has not attributed the attack to anyone and says it is working with law enforcement to identify those responsible. Blockchain analytics firms have gone further. TRM Labs attributes the theft to TraderTraitor, a North Korean hacking unit, with high confidence, and Chainalysis agrees. Elliptic calls North Korea "likely" but urges caution (The Hacker News). That is analytics attribution. As of this writing, no U.S. government agency has publicly confirmed it.
The freezes. Tether froze more than $1.5 billion in USDT and Circle froze more than $800 million in USDC. Ripple, First Digital, World Liberty Financial and Arbitrum's Security Council froze smaller amounts (Cointelegraph). Binance says about $3 billion in affected assets is frozen.
Customers. Binance says it will cover all losses from its SAFU fund and company funds. It has temporarily suspended deposits and withdrawals while it completes security checks and remediation.
Binance's customers may be made whole. The people downstream of the stolen money have no such promise.
Who gets caught in the net
Stolen crypto does not sit still. It gets sold, swapped, lent against and split up, and every step pulls in someone new. Three groups are exposed here.
Market makers, solvers and OTC desks. TRM Labs reports that the attacker sold about 325 million USDT to market makers and solvers for roughly 122,300 ETH, at a discount of more than 10 percent. Many of those counterparties will say, accurately, that they ran automated trades and never knew who was on the other side. They should expect hard questions anyway. A double-digit discount on a nine-figure trade, on the night of a public hack, is the kind of fact the government points to when it argues that a buyer should have known something was wrong.
DeFi protocols and their users. A second attacker wallet deposited 60 million USDT on Aave and borrowed about 19,760 ETH against it. Aave then froze markets. When a protocol freezes to contain stolen funds, legitimate users can end up locked out alongside the attacker.
Ordinary account holders. This group is potentially the broadest and the least prepared. Exchanges screen deposits against wallets flagged by tracing firms. If the funds you received passed through a flagged address a few hops back, your exchange may freeze your account and ask where the money came from. You may not get much more explanation than that.
A wallet's appearance in a tracing report does not, by itself, establish criminal knowledge or liability. As I wrote in that earlier post, "exposure" in a blockchain report describes how funds moved, not who knew what. But in a forfeiture case, the government goes after the property itself, and it does not need to accuse the holder of anything to do it.
What usually comes next
One common path from a private freeze to government forfeiture looks like this. The actual sequence depends on who controls the assets, why they were frozen, and what legal process investigators obtain. Some steps happen at the same time, and criminal forfeiture runs through a different mechanism than the civil cases described here.
The freeze. The stablecoin issuer or exchange locks the funds, which is happening now. A freeze imposed by a stablecoin issuer or exchange may be a private compliance or contractual action rather than a judicial seizure order. Issuers may also act in coordination with law enforcement, as Circle has said it did here. Either way, a freeze is not a government seizure, and it can last a long time.
Legal process. Investigators serve subpoenas and court orders on exchanges, issuers and protocols for account records. Your exchange may receive one about your account without telling you. Some come with orders that bar the exchange from notifying you.
Seizure. The government obtains a seizure warrant for the frozen funds. With a stablecoin, the issuer may burn the frozen tokens and reissue the same amount to a government-controlled wallet.
Forfeiture. The government then tries to keep the property, through one of two tracks.
Administrative. The seizing agency sends written notice. Your deadline to file a claim is the date stated in that notice, which must be at least 35 days after it was mailed (18 U.S.C. § 983(a)(2)).
Judicial. The government files a civil complaint in federal court, styled United States v. Approximately [amount] USDT. If you receive direct notice, your claim is due by the date stated in it, at least 35 days after it was sent. If you only see published notice, the deadline is generally 30 days after final newspaper publication or 60 days after the notice first appears on the government's forfeiture website. Rule G then gives you 21 days after filing the claim to answer or move to dismiss. The forfeiture statute, 18 U.S.C. § 983(a)(4)(B), says 20, so plan on 20 (Supplemental Rule G(4) and G(5)).
Either way, read the notice. The date in it controls.
The contest. Claimants then fight over who gets the money. Here that includes Binance. Depending on the circumstances, a victim may seek remission of forfeited property from the Justice Department, or restoration of it toward a restitution order in a criminal case.
If you miss the administrative claim deadline, the property can be forfeited without a judge ever looking at your side. People lose valid claims this way all the time, usually because the notice went to an old address or sat unopened in an inbox.
There are real defenses, and which one applies depends on when you got the property. Federal law protects an "innocent owner" (18 U.S.C. § 983(d)), but it sets two different tests.
If you already held your interest when the crime happened, you must show that you did not know about the conduct, or that once you learned of it, you did all that reasonably could be expected to stop it.
If you acquired the property afterward, as anyone who took in these funds on or after October 29 did, the bar is higher. You must show that you were a bona fide purchaser or seller for value, and that you did not know and were reasonably without cause to believe the property was subject to forfeiture.
For a desk that bought at a steep discount, the fight will be over that last phrase. Good records of how the trade was priced and screened will matter more than anything else.
The government may pay your fees. If a claimant substantially prevails in a civil forfeiture case, the United States generally pays reasonable attorney fees and costs (28 U.S.C. § 2465(b)). There are exceptions. Fees are not available to a claimant convicted of a crime that makes the property forfeitable. Where several people claim the same property, the government is not liable for fees on a claim it promptly recognizes and returns. And if a claimant wins only in part, the court reduces the award accordingly.
The sanctions problem
If the North Korea attribution is confirmed, some holders may face a sanctions question on top of the forfeiture one. Sanctions law is less forgiving. It is also narrower than the headlines suggest.
OFAC designated the Lazarus Group in 2019, identifying it as a North Korean state-sponsored hacking group. Treasury designated Bluenoroff and Andariel the same day. TRM's attribution here is to TraderTraitor, which is not one of the names Treasury listed, and no tracing label by itself establishes that particular property is blocked. U.S. persons generally may not deal in property in which a blocked person has an interest. A U.S. person who holds or controls blocked property must block it and report it to OFAC, generally within 10 business days (31 C.F.R. § 501.603). That obligation falls on whoever actually holds or controls blocked property, not on everyone whose wallet shows up in a tracing report.
The legal trigger . Coverage of this hack blurs three different things:
What private blockchain analytics firms say.
What the FBI or other law enforcement concludes.
What OFAC designates or identifies as blocked.
They are not interchangeable. A private firm's attribution is not an OFAC designation, and it is not a finding that any particular property is blocked. The real question is whether a sanctioned person has an interest in the property you hold, or whether some other sanctions prohibition applies. A tracing report alone does not answer it. An OFAC action naming specific addresses or property would change the analysis quickly for anyone holding or moving those assets.
Civil liability does not require intent. Once a sanctions prohibition applies, OFAC can impose civil penalties on a strict liability basis. "I didn't know" goes to how large the penalty is, not whether there was a violation. Criminal charges are different and require willfulness.
The practical point: if you know or suspect you hold proceeds of this theft, do not move them, swap them or send them back on your own. Even a well-meant return can create its own problem. Talk to counsel first.
What to do this week
First, an exchange freeze is not a forfeiture judgment. If your exchange account has been frozen, do not assume that the government has seized your assets, that a forfeiture case has started, or that the exchange has found any wrongdoing. A freeze means someone has flagged the funds. What happens next depends a few things… some of which you can control.
If your wallet, desk or exchange account may have touched these funds:
Do not move the funds. No swaps, no bridges, no self-help returns.
Preserve everything. Trade logs, chat messages with counterparties, pricing data, KYC and screening results, and wallet records. Turn off any auto-delete settings.
Document how the trade happened. Write down now, while memory is fresh, how the deal was priced, who approved it and what screening ran. In an innocent owner defense, that record is the evidence.
Watch your mail and email. A forfeiture notice starts a deadline. Make sure the addresses your exchange and any issuer have on file are current.
Do not talk to government investigators without advice. Cooperating is often the right call, but what you say early is hard to take back, so decide how to do it with counsel first. Your exchange's compliance team is different. It is a private company, not the government, and you will usually need to answer its questions to get your account back. Answer carefully and keep copies, because what you tell the exchange can end up with investigators.
Get counsel early. The deadlines are short, and the first few weeks set up everything that follows. My earlier post, linked above, covers these steps in more detail, including how a bad trace gets challenged.
Dynamis handles frozen account, seizure and forfeiture matters for individuals and businesses, along with the investigations that come with them. If your funds are caught up in this, contact me or any of the talented lawyers at Dynamis.
This post is general information, not legal advice, and reading it does not create an attorney-client relationship. The facts reported here are current as of October 30, 2026 and are changing quickly.
Sources
Brooke Watson, "Falsely Accused in a Crypto Scam? What to Do Next" (Dynamis, Oct. 27, 2026)
ABC News: Binance estimates security breach impact at $6.3 billion
BigGo Finance: CZ statement; Circle freeze coordinated with law enforcement
U.S. Treasury: Sanctions on North Korean state-sponsored cyber groups (Sept. 13, 2019)
18 U.S.C. § 983 (civil forfeiture proceedings; innocent owner defense)