- Published on
Binance hackers raced to move billions before it could be frozen
- Authors
- Name
- DeepHorus
Hackers behind the estimated $6.3 billion Binance breach still control billions in stolen cryptocurrency after racing to convert freezeable stablecoins into Bitcoin and Ether. The attack, the largest in crypto history, began at 8:04 pm UTC Thursday. Investigators linked the perpetrators to the North Korean hackers behind last month’s Bitget hack.
The attackers swapped assets issuers could freeze, including USDT and USDC, into BTC and ETH. CertiK engineer Dickson Wu traced $500 million in USDT to one address; $325 million was sold to market makers for ETH by 20:59 UTC, less than an hour after the hack began. Stablecoin issuers were already blacklisting addresses.
Binance said Friday about $3 billion of the stolen assets were frozen onchain out of an estimated $6.3 billion total. It is working with law enforcement, issuers and blockchain analytics firms to trace more funds. Frozen funds are not automatically recovered funds.
Tether froze around $1.567 billion in USDT, with its first major freeze 37 minutes after stolen funds reached the attacker’s main Ethereum wallet. Circle froze about $823 million in USDC three minutes later. Ripple and World Liberty Financial followed.
Arbitrum’s Security Council moved about $30.5 million in ARB and ETH into an intermediary frozen wallet, requiring further council action or a DAO vote. Aave added complexity: an attacker-linked wallet deposited $60 million in USDT and borrowed $44.6 million in wrapped Ether between 20:58 and 21:01 UTC. LlamaRisk said the position held $59.9 million in USDT collateral against $43.8 million in debt and remained overcollateralized, while Aave said suppliers were not at risk.
The case shows centralized issuers can immobilize funds quickly, but recovery depends on law enforcement and legal processes. Binance and analytics firms continue tracing additional assets. The hackers still control billions, leaving the final recovery total uncertain.
