On October 29, about $6.3 billion left Binance’s hot wallets in the largest crypto theft on record. Most of the coverage since has focused on one detail: within roughly an hour, Tether and Circle froze around $2.4 billion of the stolen USDT and USDC, while the ether and bitcoin kept moving.

The freeze is real and worth understanding. It is also the smallest part of the story. The attacker could take $6.3 billion in the first place because one company held the keys to all of it. For anyone thinking about stablecoin payment security, that is the question to start with: who, other than you, can reach your money at all?

There are four candidates: your payment provider, someone who breaks into your provider, the issuer of the stablecoin, and whoever holds your own keys. Here is how each one looks on Woldy.

Your payment provider

Most crypto payment gateways work like a traditional processor with a newer asset. The customer pays, the funds land in wallets the provider controls, and the merchant gets paid out later. For that window, the provider can hold, delay or redirect the money, whether for a compliance review, a false-positive risk flag, a change in policy or an exit from a market. None of that needs a court, and none of it shows up on-chain.

Woldy is non-custodial SaaS. Payments go from the customer’s wallet straight into the merchant’s vault, and we have no access to what sits there. This isn’t a promise about how we will behave. Even if we wanted to, or were asked to, we couldn’t hold, move or freeze those funds: the architecture gives us no way to reach them.

An attacker who breaks into your provider

The Binance hack shows the cost of concentration. When one company holds the keys for millions of balances, a single breach reaches all of them. Binance could absorb the loss, covering it from its reserves, insurance fund and corporate treasury. Most payment providers don’t have billions set aside, and in their case the merchants would be the ones left waiting.

The useful test is what an attacker would get by fully compromising the provider. On a custodial gateway, the answer is the hot wallets and every balance inside them. On Woldy, our servers don’t hold keys to merchant vaults, so taking over our infrastructure gives an attacker nothing to withdraw.

Isolation narrows the target further. Every branch of a merchant’s business gets its own vault, an isolated smart contract that holds only that branch’s funds. There is no shared pool anywhere in the system, so there is no single address worth attacking that holds everyone’s money.

The customer’s side of the checkout

Access runs in both directions. A customer paying through Woldy signs one specific payment from their own wallet, without topping up a balance or handing funds to an intermediary first. For recurring payments, the amount and schedule are encoded in the smart contract the customer agrees to, so a merchant can’t charge more, or more often, than the customer signed for. The terms can be checked rather than taken on trust.

The issuer: can stablecoins be frozen?

Yes. USDT and USDC are issued by companies, and each token contract includes a blacklist function. When the issuer adds an address, the tokens there stop moving. Ether and bitcoin have no issuer and no such switch, which is why Tether froze more than 1.567 billion USDT and Circle more than 800 million USDC while more than $1 billion, mostly in ether, got away.

A freeze contains a loss. It doesn’t return it. The attackers spread the stolen funds across roughly 12,000 wallets to outrun the blacklists, and the frozen tokens haven’t gone back to Binance yet. The switch also works on anyone the issuer names. In 2022, after US sanctions on the Tornado Cash mixer, Circle froze about 75,000 USDC, including deposits from ordinary users of the protocol.

This is a property of the money, much as a bank deposit can be subject to a court order, and it applies to every business holding USDC or USDT. Woldy accepts both, so the issuer layer stays. What segregation changes is reach. An issuer freeze touches only the address it names, and on Woldy that address belongs to one branch of one merchant. In a pooled model, the same freeze can strand every merchant whose balance happens to sit at that address.

You

Take away every intermediary and one party is left with access: whoever controls the wallet that owns your vaults. That is the point of the design, and it also means key security is yours. Treat those keys like the signing authority on a company bank account. Decide who holds them, where they are stored, and what happens when someone with access leaves the company.

When you evaluate any stablecoin payment provider, ask three questions. Who besides you can move or delay your funds? What would an attacker get by breaching the provider? And if an issuer froze one address tomorrow, whose money would be sitting at it?