Attackers behind Binance’s estimated $6.3 billion hack moved fast to turn stolen stablecoins into cryptocurrencies that token issuers could not freeze, allowing them to retain control of billions of dollars in assets even after a broad response from major industry players.
According to Cointelegraph, the incident began at 8:04 pm UTC on Thursday. The perpetrators, described in the report as linked to the same North Korean hackers behind last month’s Bitget hack, started converting assets immediately after the breach.
The strategy was straightforward: move out of assets such as USDT and USDC, which can be frozen by their issuers, and into Bitcoin (BTC) and Ether (ETH), which do not have a central issuer capable of blacklisting addresses in the same way.
CertiK engineer Dickson Wu traced $500 million in USDT sent to a single address. Of that amount, $325 million had been sold to market makers for ETH by 20:59 UTC, less than an hour after the hack started.
That put the attackers in a race against some of the most powerful gatekeepers in crypto. Tether, Circle and other issuers had already started blacklisting addresses tied to the theft.
Binance said on Friday that about $3 billion of the stolen assets had been frozen onchain, out of an estimated $6.3 billion total. The exchange said it is working with law enforcement, issuers and blockchain analytics firms to trace additional funds.
The theft is the largest in crypto history, and even with roughly half the assets already immobilized, the central question remains how much of the stolen crypto the attackers can still spend.
Assets with a freeze function
BTC and ETH are decentralized cryptocurrencies with no central issuer and no direct mechanism for an issuer to pause or blacklist balances. Centralized stablecoins such as Tether’s USDT and Circle’s USDC work differently because their issuers can freeze tokens held at specific addresses.
That gave issuers room to act quickly. Binance said it is working with law enforcement to trace the funds. Cointelegraph reported that Tether froze around $1.567 billion in USDT in total, with the first major freeze taking place just 37 minutes after the stolen funds reached the attacker’s main Ethereum wallet.
Circle froze around $823 million in USDC three minutes later. Other issuers, including Ripple and World Liberty Financial, followed soon after.
The ability to immobilize assets was not limited to stablecoins. Some decentralized protocols also intervened. Arbitrum’s Security Council moved around $30.5 million in ARB and ETH into an intermediary frozen wallet, where the funds can only be moved after further council action or a governance vote by Arbitrum DAO.
Still, frozen funds are not the same as recovered funds. Immobilizing assets can stop suspected attackers from spending them, but it does not automatically return those assets to Binance or to users.
Aave added another layer
Decentralized lending protocol Aave complicated the picture. Between 20:58 and 21:01 UTC, a wallet associated with the attackers deposited $60 million in USDT into Aave V3 on Ethereum and borrowed $44.6 million of wrapped Ether (WETH). That happened around 40 minutes before the first freeze.
LlamaRisk, an Aave risk service provider, said in a 1:00 am update that the attacker’s position later held around $59.9 million in USDT collateral against $43.8 million in debt. Aave said the position remained overcollateralized and did not put protocol suppliers at risk.
Because the USDT had already been deposited into Aave’s lending pool, blacklisting the attacker’s wallet could not automatically retrieve the collateral held by the protocol, as Aave Chan Initiative founder Marc Zeller explained.
To stop further deposits and borrowing, Aave temporarily froze markets across its V3 and V4 deployments. Existing users were still able to withdraw funds, repay loans and liquidate positions.
Aave later lifted the precautionary freeze across V3 and V4 markets, saying its contracts were unaffected and the positions remained overcollateralized.
“Just another day in crypto,” Zeller said.
What the attackers may still retain
Elliptic estimated that $2.84 billion had been frozen by 7:00 am UTC on Friday, while the attackers still controlled around $3.33 billion in assets that issuers could not immobilize.
The freeze effort cut deeply into the pool of funds available to the attackers, but that does not mean the remaining assets will be easy to recover.
Bitcoin and Ether do not have centralized issuers that can blacklist individual addresses the way Tether or Circle can. Once stolen funds are converted into those native cryptocurrencies, transactions may still be tracked or restricted in some ways, but freezing them outright becomes much harder.
Binance has said it will cover all losses using its Secure Asset Fund for Users (SAFU) and company funds, and that user assets remain safe. According to the latest update from Binance chief executive Richard Teng, the exchange is already “recovering stolen assets for users.”
