How to Request an Exchange Freeze After a Hack
Quick answer. Send the exchange's security or law enforcement team the attacker's deposit addresses, transaction hashes, amounts, a UTC timeline and a police report. Exchanges such as Binance freeze only on an official order, so involve police at once.
Video transcript
Stolen funds that reach an exchange or sit in a stablecoin can still be stopped. But the window is short, and most freezes need an official order behind them.
After the October 29, 2026 Binance hack, issuers froze about 2.7 billion dollars within hours, TRM Labs says. About 2.4 billion in ETH and bitcoin stayed beyond any issuer's reach.
Tether and Circle can freeze their stablecoins at an address. Exchanges can freeze funds in accounts they hold. Circle's policy does not cover victim requests, so route stablecoin requests through law enforcement.
Binance says it cannot freeze a user's assets without an official order from law enforcement or a court. So file the police report at once, not later.
Send every request at the same time. That means law enforcement, SEAL 911, the stablecoin issuers, the exchanges and bridges where funds land, and your analytics provider.
Make it one message a stranger can act on without a call. Include a summary, attacker and deposit addresses, transaction hashes, amounts with a UTC timeline, the police report and proof of authority.
A freeze stops transfers and buys investigators time, but it cannot reach funds swapped out first or return funds by itself, so recovery runs through legal process.
Guardian's Managed Security monitors your contracts on every block, and an engineer responds within fifteen minutes on Critical alerts. Read the full guide for the template, or talk to Guardian.
Stolen funds that reach an exchange or sit in a stablecoin can still be stopped. The window is short.
After the October 29, 2026 Binance hack, issuers froze about $2.7 billion within hours, TRM Labs says. Almost all of it was stablecoins.
This guide is the protocol's side: who can freeze, what to send and what a freeze cannot do. For token mechanics and policy text, see USDC and USDT freeze functions.
Why Speed Matters
A freeze only works while funds are in a form someone can freeze. Attackers know it.
During the Binance theft, TRM Labs says the attacker sold about 325 million USDT for ETH at a discount of more than 10%, racing the freezes.
TRM timed Tether's first freeze at 21:01 UTC, 37 minutes after the main sweep, and Circle's at 21:04.
About $2.4 billion in ETH and BTC stayed "beyond any issuer's reach." Past that point, only the exchanges and services the funds touch can stop them.
Who Can Freeze What
| Who | What they can freeze | What their policy cites |
|---|---|---|
| Tether | USDT at an address | Law, a breach, or Tether's own judgment |
| Circle | USDC at an address | Legal orders, urgent official requests, network threats |
| Exchanges | Funds in accounts they hold | Binance: an official order from police or a court |
| Bridges and other services | Varies by service | Varies; the FBI urged them to block Bybit addresses |
Tether
Tether says it "works with more than 360 law enforcement agencies across 73 countries" and that, working with law enforcement, it "can freeze funds while they are still within reach."
We found no public request form. Route your evidence through law enforcement, SEAL 911 or a Tether contact you verified in advance.
Circle
Circle's published policy limits blocks to legal orders, certain urgent law enforcement, sanctions or national security requests, and threats to its network.
A request from a victim is not on that list. Route USDC requests through law enforcement.
In the Binance case, TRM says Circle froze 823 million USDC in coordination with law enforcement.
Exchanges
Binance says it "is unable to unilaterally freeze any user's assets without an appropriate official freezing order from law enforcement or a court of competent jurisdiction."
Its law enforcement portal lets agencies mark a case "Exigent", which Binance says it will process immediately.
So the police report is not paperwork for later. It is what turns your evidence into a freeze.
Results still vary. After the November 2025 Upbit hack, KBS reported Binance blocked about 17% of what Korean investigators asked for.
Binance called reports of partial action inaccurate, per Cointelegraph.
Contact Paths
Send requests in parallel, not one after another:
- Law enforcement: in the US, file at ic3.gov; elsewhere, your national cybercrime unit. Get a reference number.
- SEAL 911: open a ticket with @seal_911_bot on Telegram. Its listed members include people from Binance, Elliptic and zeroShadow.
- Stablecoin issuers: for every token the attacker holds, on every chain.
- Exchanges and bridges: wherever traced funds land, through their security or law enforcement channels.
- Your analytics provider: to label addresses and update everyone as funds move.
WazirX shows the scale. On July 19, 2024, the day after its hack, it says it started reaching out to over 500 exchanges to block the attacker's addresses.
It had filed with India's National Cyber Crime Reporting Portal on the day of the hack. Its log records about $3 million in USDT frozen on January 17, 2025.
Verify every contact before an incident, so a request never goes to an impersonator. See what SEAL 911 is.
Following Up With Law Enforcement
Law enforcement can widen the net beyond the exchanges you reach yourself.
After Bybit, the FBI urged "RPC node operators, exchanges, bridges, blockchain analytics firms, DeFi services" and others to block transactions with the attackers' addresses.
- Give investigators the same evidence package you send exchanges.
- Ask them to mark urgent requests as exigent where a portal allows it.
- Send updated addresses as funds move, with the case number on every message.
- Ask exchanges to preserve account records, not only to freeze.
Binance's customer service will not share law enforcement information with victims. Get updates from the investigators directly.
Evidence Package Template
Send one message a stranger can act on without a call. Binance asks for an account of the incident, the transaction details, explorer links for every transaction and a police report.
For a protocol, include:
- Summary: protocol, chains, first exploit transaction time in UTC, estimated loss.
- Attacker addresses: every one, by chain, with explorer links.
- Deposit addresses: the exchange deposit addresses the funds reached.
- Transaction hashes: the exploit and each hop to the deposit, as explorer links.
- Amounts: asset and amount per deposit, with timestamps.
- Timeline: events in UTC, updated as funds move.
- Police report: agency, reference number and the investigator's contact.
- Proof of authority: your official incident post and a message signed by a known protocol address.
- The ask: freeze, preserve account records and contact the investigators.
- Your contact: a named responder reachable around the clock.
Keep the raw evidence too. SEAL's exploit runbook says to note block numbers, save mempool data if available, and document attacker addresses.
What a Freeze Can and Cannot Do
- Can stop transfers from an address or account while the hold stands.
- Can buy time for investigators to seize or return funds.
- Cannot touch ETH or bitcoin outside a service that holds them.
- Cannot reach funds swapped out before the freeze lands.
- Cannot return funds by itself.
Frozen is not returned. Tether says about 1.2 billion USDT taken through fraud and theft has gone back to owners and law enforcement through reissuance.
Lifting a freeze and returning funds both run through legal process, so plan recovery with counsel.
For how much ever comes back, see stolen crypto recovery rates.
How Guardian Helps
The first minutes decide what can still be frozen. Guardian's Managed Security monitors contracts on every block for privileged calls, upgrades, multisig transactions and large fund movements.
When something fires, a Guardian engineer responds, with a 15-minute SLA on Critical alerts. Your incident plan should list verified issuer and exchange contacts; see our DeFi incident response plan.
Frequently Asked Questions
Can an exchange freeze stolen crypto?
Yes, if the funds reach an account on that exchange. Binance says it cannot freeze a user's assets without an official freezing order from law enforcement or a court, so file a police report alongside your first request.
What information does an exchange need to freeze funds?
The attacker and deposit addresses, transaction hashes as explorer links, amounts, a UTC timeline and a police report. Binance's stolen funds page asks for an account of the incident, the transaction details, explorer links and a copy of the report.
Will Tether or Circle freeze stolen funds?
Both can block an address. Tether says it freezes funds working with law enforcement, and Circle's policy limits blocks to legal orders, certain urgent official requests and network threats. Route your request through law enforcement, with your evidence package.
Does a freeze return stolen funds?
No. A freeze stops funds moving; getting them back follows legal process. Tether says about 1.2 billion USDT taken through fraud and theft has gone back to owners and law enforcement through reissuance.
Sources
- Tether: Tether Freezes Over $1.5 Billion From Binance Hack (November 2, 2026)
- Tether: Terms of Service (updated February 26, 2026)
- Circle: Circle Stablecoin Access Denial Policy, linked from Circle's USDC risk factors page (PDF, May 2026)
- Binance: How to Report Stolen Funds Transferred to Binance (accessed November 6, 2026)
- Binance: Government Law Enforcement Request System (accessed November 6, 2026)
- TRM Labs: North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History (October 29, 2026)
- Cointelegraph: Binance and the Upbit hack funds freeze, citing KBS (December 12, 2025, updated December 15, 2025)
- WazirX: WazirX Cyber Attack, Day-wise Report (July 28, 2024, updated October 24, 2025)
- FBI IC3: North Korea Responsible for $1.5 Billion Bybit Hack (February 26, 2025)
- Security Alliance: seal-911 README and member list (GitHub)
- SEAL Frameworks: Smart Contract Exploit runbook (accessed November 6, 2026)
- FBI: Internet Crime Complaint Center (accessed November 6, 2026)
- Guardian: Managed Security
- Guardian: Guardian Announces Managed Security
Spot the theft while funds can still be frozen
Guardian Managed Security watches your contracts and fund movements on every block, with an engineer on every alert and a 15-minute SLA on Critical alerts.