Circle said on Nov. 5 that it froze approximately $1.1 billion in USDC linked to the Oct. 29 theft of roughly $6.3 billion from Binance. Elliptic says more than $3 billion in stolen assets can now be stopped only when they reach an exchange or another service, including about 233 million XRP in one address.
Circle can block transfers of USDC from affected addresses. Stopping other assets requires action by a service that receives them.
Circle’s freeze stops USDC at the address level
Circle’s blocklist prevents affected addresses from sending or receiving USDC. It cannot reverse completed blockchain transfers or control the other assets taken from Binance. Circle said valid legal processes authorized its action, and that the freeze does not decide ownership or forfeit the assets.
TRM Labs identified 823 million USDC in its account of Circle’s freeze. Its tracing describes how the attacker gained access to those funds:
The wallet also served as the executor of a separate Binance smart account, which gave the attacker the ability to pull 823 million USDC from it. Circle froze that USDC shortly afterward.
TRM’s 823 million USDC figure refers to the amount pulled from the smart account. Circle’s approximately $1.1 billion is its freeze total as of Nov. 5. The figures do not establish how much the amounts overlap, so they should not be added together.
TRM counted about $2.7 billion frozen onchain as of 00:30 UTC on Oct. 30, after stablecoin issuers began blocking stolen funds. That figure covers an earlier point in the response and includes action across issuers. It is a different measure from Circle’s Nov. 5 total.
More than $3 billion now depends on an off-ramp
Elliptic says about 233 million XRP remains in one address. Circle’s blocklist acts on USDC, so it cannot stop that XRP from moving.
Elliptic’s account of its tracing work places the XRP inside a larger pool of stolen assets. It identifies a receiving service as the next place those assets can be stopped:
More than $3 billion of the stolen assets, including 233 million XRP sitting in a single address, can now only be stopped when they reach an exchange or other service.
For those assets, the next control point is the service where the attacker sends them. The service can screen an incoming transfer against addresses linked to the theft and act on a match before the funds are cashed out. Elliptic says its alerts have already led to freezes of some stolen Binance funds.
Screening determines who can cash out
Elliptic has published a free CSV blocklist containing more than 8,000 addresses linked to the theft. A crypto business can download the file and compare its entries with addresses involved in incoming transfers. Elliptic says its investigators update address data as the assets move through bridges, swaps and mixers.
- At the issuer: Circle can stop blocked addresses from moving USDC.
- Onchain: Tracing can follow stolen assets as they move to new addresses.
- At a service: An exchange or other recipient can act on a match before funds are cashed out.
Each control applies at a different point. Circle’s block takes effect at the token level for affected USDC addresses, while tracing identifies where stolen funds go next. Screening gives a receiving service the address information it needs to decide whether to stop a deposit.
That sequence matters when the attacker moves assets through a swap or bridge. Elliptic says it updates its data as those transfers occur, and businesses using its screening tools receive alerts when funds linked to the theft arrive. A service that acts on a match can block a cash-out route beyond Circle’s reach.
The 233 million XRP balance remains in one address. The next marker is a transfer from that address to an exchange.
