- Hackers stole about $6.3 billion from Binance, and the attacker is converting freezable stablecoins into Ether, Bitcoin and TRX that no issuer can lock.
- Stablecoin issuers, Arbitrum’s Security Council and firms like 1inch have frozen roughly $3 billion.
- About $2.86 billion sits in assets with no freeze function.
The attackers in the $6.3 billion Binance theft have started to split their haul along the lines of assets that can be frozen or potentially clawed back and assets beyond freeze controls.
On one hand, stablecoin issuers are already pulling blacklist and freeze levers, while the hackers are racing to cross over to ETH, BTC and other tokens with no issuers or off switches.
The scramble to wall off tokens before they cross into unrecoverable territory follows what has been described as the biggest theft in crypto history, which, ironically, hit the world’s largest crypto exchange.
Binance’s initial report of the incident has blamed the exploit on a compromised DevOps engineer’s laptop.
What has been frozen from the Binance hack?
The Binance attackers, whom TRM Labs and Chainalysis have, with high confidence, fingered as North Korea’s TraderTraitor unit, have lost nearly $3 billion of the tokens they moved from the exchange.
The issuers of the largest stablecoins by market cap, Tether and Circle, have both blacklisted about 1.77 billion USDT and 825 million USDC, respectively, according to TRM Labs.
Of the stolen 88.5 million RLUSD stablecoin, Ripple has frozen 40.5 million, while Trump-linked World Liberty Financial has locked 27.8 million of its USD1 token.
Arbitrum’s Security Council also pulled a lever that helped it stop $30.5 million.
However, the North Korea-linked attackers still have almost $3 billion that no entity can touch, per Arkham and Lookonchain tracking: roughly $1.09 billion in ETH, $1.41 billion in BTC and 682.9 million TRX.
The attacker raised $158.25 million from selling altcoins like AAVE, ENA, LINK, PEPE and UNI. All of that money has since been converted into Ethereum, a non-freezable asset.
Who can intervene and who can’t?
DEX aggregator 1inch and the Reserve protocol present a side-by-side comparison of the intervention bridge that the hackers are looking to cross.
1inch said exploit-linked addresses have already been blocked from accessing its dApp, wallet and API. It also said it has reached out to Binance to offer help and is coordinating with ZeroShadow, SEAL 911 and TRM Labs.
Reserve, on the other hand, could not do anything to stop the attackers when they swept up about 3.4 billion of its RSR token. The team wrote on X that “no one, including us, can freeze” the tokens because RSR is immutable and has no admin keys.
Arbitrum’s Security Council temporarily modified the network’s inbox contract on Ethereum, added a function to reproduce a cross-chain transaction while impersonating the exploit address, and moved 8,425 ETH and 74,559,805 ARB into a holding wallet ending in 0DA0, according to the Arbitrum governance forum.
The council then restored the contract. The funds can only move after an ArbitrumDAO vote.
The council used the same emergency powers in April, when it froze about 30,766 ETH, worth roughly $71 million, tied to the KelpDAO exploit.
What the Bitget hack already showed
Frozen is not recovered, and the industry has fresh proof of how little freezing can catch once an attacker converts. In the September Bitget breach, Cryptopolitan reported that Circle and Tether locked just $318,000 out of $387.5 million stolen, because the thief had already swapped the rest into Ether.
Bitquery data cited by Cryptopolitan shows wallets frozen within a week keep 59% of their USDT after a week but only 12% after six months.
Binance has suspended deposits and withdrawals, pledged to cover user losses from its SAFU reserve and company funds, and expects withdrawals to resume within 48 hours.
Co-CEO Richard Teng wrote on X, “Your money is safe and we’re covering every loss.” The exchange has not said how much of the frozen $3 billion it can actually reclaim, or what will happen to the remaining $3.3 billion.
If you're reading this, you’re already ahead. Stay there with our newsletter.
FAQs
How much did hackers steal from Binance?
Binance estimates the breach at about $6.3 billion, which TRM Labs and Chainalysis describe as the largest theft in crypto history. Roughly $3 billion has been frozen on-chain so far.
Why can't the stolen Ether and Bitcoin be frozen?
ETH, BTC, TRX and SOL have no central issuer and no blocklist, so no company can stop them from moving, unlike USDT or USDC, whose issuers can blacklist addresses. That is why the attacker is converting frozen-capable stablecoins into those coins.
Who is coordinating the response to the hack?
Stablecoin issuers Tether, Circle, Ripple and World Liberty Financial have frozen tokens, Arbitrum's Security Council locked $30.5 million in ETH and ARB, and 1inch blocked the exploit addresses while working with ZeroShadow, SEAL 911 and TRM Labs.
Disclaimer. The information provided is not trading advice. Cryptopolitan.com holds no liability for any investments made based on the information provided on this page. We strongly recommend independent research and/or consultation with a qualified professional before making any investment decisions.
Hannah Collymore
Hannah is a writer and editor with nearly a decade of blog writing and event reporting experience in the crypto space. At Cryptopolitan, Hannah contributes to the news page, reporting and analyzing the latest developments in DeFi, RWA, crypto regulation, AI and frontier tech industries. She graduated from Arcadia university with a degree in Business Administration.
