The money came back because it could be frozen

Of the $6.3 billion, Binance and its partners have frozen over $2.3 billion. Not recovered by clever forensics — frozen, because a large share of what was taken sits on ledgers where an issuer can switch an address off. Circle can freeze USDC. Tether can freeze USDT. They did.

That is the same property most readers of this site dislike, doing the thing it is for. The money came back in large part because somebody had the power to stop it moving, and the people who hold that power over a stablecoin hold it over yours too, on the same day, for whatever reason satisfies them. You cannot have the recovery without the switch. Anyone selling you one without the other is selling you something.

It is worth being plain about where that leaves the argument for Monero: an untraceable ledger would not have let anyone freeze $2.3 billion of it. That is a cost of the thing, not a footnote to it.

If you are swapping without an account, the custody risk in this story was never yours. The exposure that is yours is downstream: several billion dollars of tainted coin is now in circulation, screening across the industry has tightened, and the chance that an ordinary deposit gets flagged went up for everybody.

A non-custodial swap does not protect you from that. The provider still sees the coins you send. If their analytics vendor dislikes the history behind them, what happens next is governed by their terms, and those terms are already quoted on our risk page, with the date each was read.

ChangeHero’s terms of use, paragraph 3.7, read 2026-10-16:

In case the User does not wish to disclose their identity for certain reasons and refuses to undergo the KYC/AML procedure, ChangeHero has the right to terminate the exchange and the deposited funds are then transferred back to the initial address the deposit was made from, subtracting the network fee and ChangeHero operational fee in amount of 10% from transferred assets but not less than 100 USD equivalent.

Their partners desk told us on 2026-10-17 that this clause is waived for direct API integrations, which is how visitors arrive from here. We print both, because the waiver is an email and the clause is the document with legal force. And note what the waiver covers: the 10% charge for declining. Nothing in it says you will not be asked.

Exolix’s terms, read 2026-10-01, are shorter:

If you refuse to provide such information, we are not responsible for ensuring the refund or completion.

Those two sentences are the actual mechanism by which a theft at an exchange you have never used costs you money. Not the theft. The screening that follows it, meeting a clause you agreed to without reading.

On 2 November Binance issued an advisory warning that the phased withdrawal reopening was being exploited: people posing as Binance staff, fake compensation offers, phishing by SMS and QR code, and offers to move your withdrawal up the queue for a fee. There is no such service. There is never such a service.

The general form is worth holding on to, because it long outlives this incident: after a large theft, the most profitable attack is not on the exchange, it is on the people waiting to be made whole. A recovery firm that finds you is a scam. A support agent who messages you first is a scam. A refund that needs a wallet approval is not a refund — it is the approval.

For what it is worth about this site specifically: there is no account here to be compromised, nobody here will ever message you first, and nothing here can recover a transfer, including when you would very much like it to. That last one is not a feature. It is the other side of never holding your money, and we would rather you knew it on a quiet day than found out on a bad one.

Everything above about Binance is read from reporting and from Binance’s own statements, between 29 October and 2 November 2026. None of it is measured by us, and figures in a moving story age badly — the frozen total in particular has been reported at several different numbers as the count changed. The two clauses are ours: quoted verbatim from the providers’ own documents, each with the date it was read, and re-read rather than remembered.