Billions of dollars were frozen on-chain within days, although published figures differ. Stablecoin issuers including Tether and Circle froze affected tokens, and Arbitrum's Security Council froze ETH and ARB tied to the attacker. Binance put the frozen total at about $3 billion. Blockchain analysts reported that the attacker still controlled a large share, which was being converted into Ether and laundered.
Why the frozen amount is reported differently
The headline number depends on what is being counted and when. Some reports refer to tokens that were frozen directly on-chain, while others combine stablecoins, protocol-linked assets, and funds immobilised through exchange and wallet interventions. That is why published totals can be simultaneously credible yet not identical.
In practice, the important distinction is between assets that are frozen, meaning they can no longer move through the attacker’s control path, and assets that are merely traced, which may still be spendable until a third party or protocol action blocks them.
For readers trying to reconcile figures, the safest approach is to treat the published total as a moving operational snapshot rather than a final accounting statement. In fast-moving crypto incidents, the frozen amount can change as issuers, exchanges, bridges, and chain governance bodies react at different speeds.
What “frozen on-chain” actually means in a crypto theft
Freezing in this context usually means that a token issuer, a protocol admin path, or a governance-controlled mechanism has disabled transfer or redemption for specific assets tied to the attacker. That is materially different from traditional asset recovery, because the response often depends on whether the asset is centrally issued, upgradeable, or governed by a control group that can intervene.
The practical effect is to reduce the attacker’s liquidity and force them toward harder-to-move assets, alternate chains, mixers, bridges, or conversion steps. It does not necessarily mean the funds are permanently recovered, only that the original theft route has been disrupted.
Where the frozen assets include stablecoins or chain-native tokens, the response can be rapid because issuers and protocol operators can act faster than a conventional legal recovery process. Where the attacker has already diversified across wallets and assets, the freeze becomes only one part of a wider containment effort.
Why freeze totals are only one part of the recovery picture
A freeze total says something about containment, not about final loss. The attacker may still control other assets, move value through cross-chain routes, or convert remaining holdings into Ether or other liquid assets that are harder to stop without broader exchange cooperation.
That is why incident response for stolen crypto needs to track three separate questions at once: what has been frozen, what is still movable, and what has already been laundered. The answer to each can diverge quickly, especially when multiple issuers and protocols act independently.
This is also where operational coordination matters. A freeze initiated by one issuer or council can be highly effective for that specific asset class, but it does not automatically stop downstream cash-out paths. Analysts therefore look for both asset-level freezes and signs of continued conversion activity before judging the incident contained.
Risk and Threat Considerations
When stolen crypto is frozen only partially, the remaining risk is not just residual loss, it is continued mobility. Attackers often shift immediately into conversion and fragmentation, using the unfrozen portion to preserve value and complicate tracing before more controls can take effect.
Failure mechanism: The freeze blocks some tokens or addresses, but not the attacker’s wider control over unfrozen assets, alternative routes, or rapid conversion paths, so value can keep moving even after headline containment.
Impact: A partial freeze can buy time and reduce exposure, but it does not prove the incident is resolved, and it can leave responders with a misleading sense of closure if they stop tracing too early.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1657 — Financial Theft | Crypto theft and laundering map to financially motivated attacker activity. |
| Recommendation — Track conversion and laundering steps as part of the attacker’s post-compromise chain. | ||
| NIST CSF 2.0 | RS.MI-01 — Incidents are contained | Freezing assets is a containment action that limits further attacker movement. |
| RC.RP-01 — Recovery plan is executed | Crypto theft response depends on coordinated recovery and freeze actions. | |
| Recommendation — Use containment actions to stop further value movement before recovery begins. Execute the recovery plan across issuers, exchanges and affected chains. | ||
| CIS Controls v8 | CIS-17 — Incident Response Management | Stolen crypto freeze and tracing are incident response coordination tasks. |
| Recommendation — Maintain an incident response process for asset freezes, tracing and communications. | ||
Practitioner Guidance
What to verify: Separate frozen assets from traced assets, and confirm which controls actually halted movement versus which only identified the attacker’s wallets. If the same theft is being discussed across multiple reports, reconcile whether the number refers to issued tokens, on-chain balances, or total estimated value.
What practitioners underestimate: Freezing is usually an operational containment measure, not a recovery endpoint. The most important next question is whether the attacker still holds liquid value that can be bridged, swapped, or dispersed before additional freezes land.
Practitioner takeaway: Treat the frozen total as a containment indicator, not a final loss figure, and keep tracing until you can distinguish immobilised assets from value that is still being converted or laundered.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org