Who Actually Controls Your Crypto After Binance
Key Takeaways
- The Binance hack is a useful stress test, not because of the loss size but because of what the response revealed about who actually controls crypto assets. Around $3 billion got frozen on-chain out of roughly $6.3 billion affected, and the mechanics of how that freeze happened matter more than the headline number.
- Your key gives you the ability to sign a transaction. The issuer gives the network the ability to refuse it. Those are different layers of control, and they do not always travel together.
- The chain is not neutral either. TRM reported that Arbitrum's Security Council used emergency powers to move stolen ETH and ARB out of an attacker's wallet. The intervention surface for any asset is the issuer, the chain, any council or multisig with emergency powers, any bridge, any oracle, and anyone else who can block, pause, or rewrite.
- Native bitcoin behaves differently. There is no issuer with a blacklist function that can disable someone's BTC. A decentralised blockchain can still host a centrally controlled token, which is why the asset's control model matters more than the chain it sits on.
- 'Your keys, your crypto' remains a strong starting point. The honest version is longer. Who else has power over the asset, and under what circumstances would we want them to use it? That is the question the Binance hack has put in front of the industry.
The Binance hack is a useful stress test. Not because of the size of the loss, but because of what the response revealed about who actually controls crypto assets.
In its 30 October 2026 update, Binance estimated roughly $6.3 billion was affected, with around $3 billion frozen on-chain. [2] [4] The company said it would cover losses using its SAFU fund and company funds. [4] [6]
That commitment matters to customers. But the mechanics of how that $3 billion got frozen are more interesting than the headline number, and they expose something most crypto holders would rather not think about.
Who actually controls your tokens?
"Your keys, your crypto" is the sentence everyone in crypto learns first. It's a good sentence. It is also incomplete.
When an exchange holds your assets, you depend on its security, its infrastructure and its willingness to process your withdrawal. The exchange has a reassuring brand and a familiar interface. It also has the keys. If something goes wrong on their side, your position goes with it.
Self-custody changes the relationship. Holding your own keys gives you direct control over your wallet and removes the dependency on an exchange to authorise anything. It also hands you full responsibility for protecting those keys and understanding every transaction you sign. A stolen recovery phrase. A malicious signature. A lost backup. Any one of those can be the end of the story.
Trading on an exchange and trusting it to store your assets are two different decisions. Convenience makes them feel like one.
That's the first useful lesson from this incident. Understand who actually holds the keys to the position on your screen. Which brings up the harder question.
If I hold the keys, who else can freeze my tokens?
Here is where the Binance response gets uncomfortable for the standard crypto narrative.
TRM Labs' investigation of the hack documented the attacker converting stolen stablecoins into ETH and borrowing ETH against stolen USDT, moving steadily from freezable assets into non-freezable ones. [3] That movement only matters because the starting assets could be frozen in the first place.
From a victim's perspective, that power is extremely valuable. Stopping stolen funds from moving opens a window for recovery, though freezing is not the same thing as returning. From the perspective of someone who bought into crypto to escape exactly that kind of intervention, it's a problem.
For Bitcoin, resistance to centralised intervention is fundamental. There is no issuer with a blacklist function that can simply disable someone's native bitcoin. [2] [5] The wider crypto system is different. A decentralised blockchain can host a centrally controlled token. Transaction validation can be distributed across thousands of nodes while the token itself gives one company the power to restrict transfers.
Different layers of control. They don't always travel together.
What about the network itself?
The network isn't neutral either, and the Binance response made that explicit.
TRM reported that Arbitrum's Security Council used emergency powers to move stolen ETH and ARB out of an attacker's wallet on Arbitrum. [3] Simply knowing the name of the asset does not tell you every intervention power surrounding it.
Who freezes crypto on-chain since 2016: stablecoin issuers vs. blockchains
The verified data points are Frozen by stablecoin issuers: $6.4B (2016 to 16 Oct 2026); Frozen/moved/rolled back by blockchains: $755M (2016 to 16 Oct 2026).
Scroll the chart sideways to see every point.
| Label | Value | Unit | Period |
|---|---|---|---|
| Frozen by stablecoin issuers | $6.4B | USD millions | 2016 to 16 Oct 2026 |
| Frozen/moved/rolled back by blockchains | $755M | USD millions | 2016 to 16 Oct 2026 |
A useful reframe. The intervention surface is not just the issuer. It's the issuer, the chain, any council or multisig with emergency powers, any bridge, any oracle, and anyone else who can block, pause, or rewrite. The permissionless story people repeat to themselves gets more conditional the deeper you look.
None of this is a secret. It is in the documentation. But most holders have not actually mapped the full stack of parties who can touch their position, which means they have not actually priced the risk they are carrying.
Where should the line sit?
So where do we draw the line between protective intervention and censorship?
Picture a thief who has just stolen customer deposits. Most people would welcome an intervention that stops the money from disappearing. Now picture an innocent person whose government wants to restrict their access to money. The technical ability to stop a transfer does not decide which situation is justified. That judgement belongs to whoever controls the mechanism.
Who should have that authority? What evidence should they need? What happens when they make a mistake? Can the affected person contest the decision? These are not crypto questions. They are the same questions societies have been asking about banks, courts and payment rails for decades. Crypto did not escape them. It rearranged who holds the power.
There is a further complication the Binance incident makes concrete. Freezable and issuer-unfreezable assets trade alongside each other. An issuer's control over its own token does not automatically extend to the asset received in exchange for it. That creates a race between intervention and conversion, with other market participants potentially caught in between.
I don't have a neat answer to any of this. I can see why people want money that no company or government can arbitrarily freeze. I can also see why victims of the largest hack in crypto history want someone to intervene when their savings are stolen. The Binance hack puts those two desires side by side and refuses to resolve them.
What this means for operators holding crypto on the balance sheet
If you run a company that holds any crypto, the practical takeaway is less philosophical.
Build an actual map of your intervention surface. For each asset you hold, write down who can freeze or move it against your will. Not in theory. In practice. The issuer. The chain. Any council. Any bridge contract between you and your custody solution. Any custodian layered on top. The map will be longer than you expect.
Then price it. The right custody arrangement for a treasury position in BTC is not the same as the right arrangement for a working balance in a stablecoin, because the intervention surface is not the same. Treating them as the same category because they both live in a wallet is the kind of simplification that gets you in trouble when something unusual happens on-chain.
Decide, in advance, how you would feel if an intervention was used against you by mistake. The error rate on these mechanisms is not zero. The ability to challenge the decision is not well established. If your business cannot operate for a week while you argue with an issuer, that's a design problem to fix now, not during the incident.
Verified data from arxiv.org
Verified values from the cited source are shown below.
Scroll the chart sideways to see every point.
| Label | Value | Unit | Period |
|---|---|---|---|
| Sanctioned USDT addresses drained to zero before freeze took effect | 7.3% | percent of sanctioned USDT addresses | Nov 2017 – Aug 2025 |
| Sanctioned USDC addresses drained to zero before freeze took effect | 18.7% | percent of sanctioned USDC addresses | Nov 2017 – Aug 2025 |
"Your keys, your crypto" remains a strong starting point. The honest version of the sentence is longer. Who else has power over it, and under what circumstances would we want them to use it?
That is the question the Binance hack has put in front of the industry. The answers will shape what crypto actually is over the next decade, far more than any price chart will.
If you are thinking through this on your own balance sheet, tell me where I am wrong. I am still working out my own position.
Research notes
Research checked 30 October 2026.
Sources
- Ordering Power is Sanctioning Power: Sanction Evasion-MEV and the Limits of On-Chain Enforcement, arxiv.org Retrieved 30 October 2026.
- Binance's $6.3 billion hack: What we know and what comes next, CNBC Published 30 October 2026. Retrieved 30 October 2026.
- North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History | TRM Labs, www.trmlabs.com Retrieved 30 October 2026.
- Binance hack updates: Crypto giant hit by $6.3bn hack - BBC News, BBC News Retrieved 30 October 2026.
- Crypto Censorship: Issuers Froze $6.4B, Blockchains $755M - Bitquery, Bitquery Published 18 October 2026. Retrieved 30 October 2026.
- Was Binance Hacked? Crypto Exchange Says Funds Are Safe After ‘Potential Security Issue’, Forbes Retrieved 30 October 2026.
Infographic
Frequently Asked Questions
- Does 'your keys, your crypto' still hold after the Binance hack?
- It's still a strong starting point, but it's incomplete. Your private key lets you sign a transaction. The chain's security council can move the asset out of your wallet. Holding the keys is one layer of control, not all of them.
- Who can actually freeze tokens in a wallet I control?
- On some chains, a security council or multisig with emergency powers can also move assets. TRM documented Arbitrum's Security Council doing exactly that during the Binance response.
- Why does native bitcoin behave differently from stablecoins here?
- There is no issuer sitting behind native BTC with a blacklist function that can disable it. A decentralised blockchain can still host a centrally controlled token, so the asset's control model matters more than the chain it lives on.
- Where should the line sit between protective freezing and censorship?
- I don't have a neat answer. Stopping a thief and restricting an innocent person use the same technical mechanism. The judgement sits with whoever controls it. The real questions are who has that authority, what evidence they need, and how a mistake gets contested. Societies have been asking these about banks and payment rails for decades.
- What should an operator holding crypto on the balance sheet actually do?
- Map your intervention surface, asset by asset. Write down who can freeze or move each position against your will: issuer, chain, council, bridge, custodian. Then price it. A BTC treasury position and a stablecoin working balance are not the same category just because they both sit in a wallet.
- What was actually frozen in the Binance hack?
- Binance's 30 October 2026 update estimated roughly $6.3 billion was affected, with around $3 billion frozen on-chain. The attacker then converted stolen stablecoins into ETH and borrowed ETH against stolen USDT, moving steadily from freezable assets into non-freezable ones. The freeze mattered because the starting assets could be frozen in the first place.