When Is a Hack a Defense? Custodial Liability, Issuer Freezes and the Public Loss after the Binance Theft of 29 October 2026

On 29 October 2026 about $6.36 billion was taken from Binance's hot wallets on ten blockchains, most of it in a first wave of about twenty minutes. The FBI attributes the theft to TraderTraitor, a North Korean unit. This paper asks who owes what when a sanctioned state robs a systemic exchange, and in particular who answers for the public loss once the users have been repaid and the funds that escaped have reached a state under sanctions. It examines three duty-holders in turn: the custodian, the stablecoin issuers whose tokens could be frozen, and the state that attributes, designates and forfeits. The analysis combines U.S. sanctions law, the 2023 Binance resolutions and the GENIUS Act with on-chain evidence from a signed fund-flow case traced with SanctionFlow from the attacker's main Ethereum wallet forward from the first theft transaction; the case is public at sanctionflow.io/flows/binance-hack-stolen-funds-ethereum. The case shows that 700 million USDT left the attacker's main wallet within nine minutes, before any freeze: 325 million was sold for ether, 170 million moved through Uniswap swaps and an Aave deposit, and 205 million stopped and is reported frozen. 60 million USDT became Aave collateral for a 19,762 WETH loan less than three minutes before the wallet holding it was blacklisted. Circle's single freeze caught all 823 million USDC. Binance's compromised hot wallet was still sending funds to the attacker 43 minutes after Tether had blacklisted the receiving address. Three kinds of freeze (issuer, protocol, network) acted at three levels and none at the level of a position. Three proposals follow: a failure-to-prevent standard for systemic custodians under which "we were hacked" is a defense that must be proved, as it already is for a bank under UCC Article 4A, and under which repaying users does not discharge what is owed to the public; a default hold for registered custodial wallets at the issuer layer, an interoperable freeze standard and a disclosed time-to-freeze; and a graded emergency signal with a safe harbor, a legal status within the GENIUS Act's lawful-order definition where existing authority supports it, and screening capacity treated as public infrastructure. The paper also proposes six measures (time-to-freeze, address exit ratio, route disposition, freeze coverage, attacker-controlled value, cost of escape) for the next incident. The case covers Ethereum only; the attribution is the FBI's and is disputed by North Korea; the paper asserts no finding that any party violated any law.