Mentioned in This Article
1. What does Arkham's new frozen view show?
Arkham Intelligence, the blockchain analytics platform, has added a frozen asset view to its portfolio module, launching on November 5, 2026. The feature separates tokens that are frozen, locked, blacklisted or destroyed from the balance a wallet can actually spend, starting with the stablecoins USDC, USDT and USDT0. Arkham demonstrated it on an entity it labels the Binance Hacker, which holds about $5.8 billion in total digital assets, of which about $2.6 billion is frozen.
A portfolio tool normally reports a single number for what an address holds. That figure can mislead when part of the balance is stuck. Arkham's change answers a narrow but practical question for anyone tracking a wallet: how much of this balance can its owner move today, and how much is out of reach?
The module now carries a dedicated Frozen button. Pressing it reveals the portion of a wallet's holdings that has been immobilized, kept apart from the liquid balance shown by default. The split applies to individual wallets and to entities that Arkham groups together from many addresses.
2. How does the frozen asset view work?
Arkham's portfolio module aggregates holdings across wallets and across blockchains, and users can connect their own wallets and exchange accounts to see combined balances in real time. The frozen view adds a second layer to that picture. Instead of presenting every token as equally spendable, it flags the tokens that an issuer or a protocol has locked.
At launch, coverage is limited to three assets: USDC, USDT and USDT0. Arkham has said it plans to add more tokens over time. The choice of starting point is deliberate, because stablecoins are where freezes matter most often. Their issuers, Tether for USDT and Circle for USDC, hold the technical ability to freeze tokens at a given address, which makes a freeze a routine tool in responses to hacks and sanctions cases.
The distinction between the categories the feature names is worth spelling out. A frozen token is one an issuer has blocked from moving. A blacklisted address is one barred from transacting in a token. Destroyed tokens have been burned and no longer exist in usable form. All of them share one trait: they appear in a wallet's history, yet none can be sent on to another address.
3. The Binance breach that set the stage
The demonstration entity comes from a breach of Binance's hot wallet on October 29, 2026, in which an estimated $6.01 billion was taken. Tether and Circle responded by freezing large amounts of the affected stablecoins. Arkham tracked about $2.80 billion in frozen assets shortly after the incident.
The newly displayed figures are slightly different. In the Binance Hacker example, roughly $2.6 billion is frozen: $1.77 billion in USDT and $824.72 million in USDC. Added together, the two stablecoin amounts come to about $2.59 billion, in line with the rounded total. That sits below the $2.80 billion tracked earlier, and the new view makes it possible to watch that number directly instead of reconstructing it from issuer announcements.
Other published accounts of the episode cite slightly different totals depending on the date and the method of counting. Binance itself said that a verified amount of about $2.54 billion had been frozen and that the figure could rise as investigators trace more of the stolen funds. The variation shows why a consistent, wallet-level view is useful: totals move as freezes are executed and as funds are traced.
4. How stablecoin freezes work in practice
A stablecoin freeze is a function written into the token's smart contract. The issuer maintains a list of restricted addresses, and the contract refuses to process transfers from any address on it. The tokens remain visible on the blockchain, and the address still appears to hold them, but they cannot be sent anywhere until the issuer removes the restriction.
That design is the reason freezing is attractive after a theft. A thief who converts stolen funds into a freezable stablecoin remains exposed to the issuer's decision, while one who swaps into assets without an issuer, such as bitcoin or ether, is beyond that reach. The contrast explains why the frozen share of a stolen sum depends heavily on which assets the attacker holds when the freezes arrive.
Issuers usually act in coordination with law enforcement and the victim of the theft. Tether and Circle each froze substantial balances linked to the October 29 breach, which is how the Binance Hacker entity came to carry more than $2.5 billion in locked USDT and USDC at once.
5. Why total balance and movable balance are different numbers
The example illustrates a gap between two readings of the same wallet. A holding of $5.8 billion sounds like an ongoing crisis, since a large pool of assets sits under the control of an attacker. Seen through the frozen lens, about $2.6 billion of it cannot move, which points to a partial containment of the damage.
That arithmetic leaves roughly $3.2 billion that is not marked as frozen within the entity's total, though it is not necessarily all in assets covered by the new view. Arkham's coverage includes only three tokens, so the remainder may include other assets whose status the feature does not yet check. The result is an upper bound on what an attacker could still deploy, not an exact measure of it.
For observers, the point is that headline totals are only the starting point. A balance can be large and still be largely inert, or it can be modest and fully liquid. Until this update, separating the two for stablecoins required reading issuer statements, checking blacklist contracts or tracing transfers by hand.
6. What does it mean for traders, investigators and compliance teams?
Arkham marketed the feature to users ranging from individual traders to compliance departments, and each group gains something different. Investigators can see how much of a suspect's holdings can realistically be moved or cashed out, which shapes how they prioritize their efforts. Knowing that a large share is already frozen narrows the pool of assets that still require attention.
Compliance teams can separate live exposure from immobilized balances when assessing counterparties. An address that holds a large balance, most of it frozen, presents a different risk than one whose entire balance is spendable. Reporting both figures side by side supports a more accurate picture of what a counterparty can actually do.
Traders and holders of stablecoins across several wallets benefit as well. They can check whether any part of their balance has been caught in an issuer freeze, rather than discovering it at the moment they try to send funds. For a person managing many addresses, an unexpected freeze is a liquidity problem that is far better found early.
The same logic applies to anyone doing due diligence on a protocol treasury or a fund's on-chain holdings. A treasury that appears to hold hundreds of millions in stablecoins may in fact hold a smaller liquid amount if part of the balance sits at blacklisted addresses.
7. Where the feature falls short
Any tool that labels wallets must also decide what counts as a single owner. Arkham groups many addresses under one entity, and the frozen view inherits that grouping, so the numbers shown for an entity are only as reliable as the underlying attribution.
The limits are clear from the launch scope. Only USDC, USDT and USDT0 are covered. Frozen or locked holdings in other tokens are not flagged, so a wallet that holds other freezable assets may show a liquid balance larger than what can really be moved. Users should treat the figure as accurate for the three supported stablecoins and incomplete beyond them.
There is also a timing consideration. A freeze takes effect when an issuer acts, and an analytics platform reflects it only after it detects and labels the change. During that interval, a displayed liquid balance may overstate what is movable. Arkham's own plan to widen coverage will narrow the first limitation, but the lag between an issuer action and its appearance on screen is inherent to any labeling system.
Finally, entity labels such as Binance Hacker are Arkham's attributions, assembled from on-chain behavior and tracing. They are useful for analysis, though they reflect the platform's judgment rather than a legal finding.
8. What comes next for the tool and the Binance trail
Arkham has said more tokens will be added to the frozen view, though it has not given dates or a list. Each addition would extend the reach of the feature beyond stablecoins to other assets that carry freeze or blacklist functions.
For the Binance case specifically, the gap between the $2.80 billion tracked shortly after the breach and the roughly $2.6 billion in the current example is now easy to monitor. If issuers freeze more tokens as tracing continues, the frozen share of the entity's $5.8 billion should rise. If funds are moved out of the covered tokens, it may fall. Either movement will be visible in the module without any change to the user's own setup.
Readers following the case should note that every figure in this article reflects Arkham's tracking as of the launch date and that totals may shift as investigators continue their work.
The broader takeaway is that visibility into what can and cannot move has become a standard question in crypto analytics. Large thefts are now followed by rapid issuer freezes, and tools that distinguish immobilized balances from spendable ones help traders, investigators and compliance staff read those events accurately as they unfold.