Synthetix recovers SNX, Newton tokens locked as Binance haul hits walls

Synthetix has recovered the SNX stolen in Binance’s $6.3 billion hack, while the attacker accidentally locked about 8 million Newton tokens in a dead contract.

They are two of at least nine moves against the haul.

At least nine moves against one haul

Binance confirmed that about $6.3 billion was stolen in what is now the largest exploit in crypto history. It is over four times the $1.5 billion Bybit hack of February 2025, which was the largest before now.

Several investigators have tied the attack to North Korea’s TraderTraitor unit. Binance has blamed a compromised DevOps engineer’s laptop.

So far, close to $3 billion of the stolen funds have been frozen or locked across chains. Issuers of centralized stablecoins have been responsible for freezing the largest amounts.

Tether blacklisted around $1.77 billion USDT, and Circle did the same for about 825 million USDC. Other platforms that have frozen some of the stolen funds are Ripple, which was able to freeze 40.5 million out of the 88.5 million RLUSD that was moved. World Liberty Financial locked 27.8 million USD1.

Arbitrum’s Security Council also came through as they used emergency powers to wall off $30.5 million in ETH and ARB, and DEX aggregator 1inch blocked the exploit addresses from its apps, wallet and API.

Why an admin key decides everything

The issuers of stablecoins, especially the centralized ones, have a blacklist function or an admin key. The same function is also found on the tokens of certain protocols such as Arbitrum.

What this function does is that it enables an issuer or a controlling DAO to reverse or freeze a transfer before it gets to its intended destination. Native assets like Ethereum’s Ether (ETH) and Bitcoin (BTC) do not have issuers, and they do not come with off switches either. Such tokens are usually moved without a company or DAO stopping them

There are also tokens that are immutable by design. They cannot be frozen; however, they can still be lost, for they end up somewhere they can never move from.

Reserve ran into that limit. When the attacker swept up about 3.4 billion of its RSR token, the team wrote on X that no one, including the project itself, could freeze them, because RSR has no admin keys. 

Freezable tokens get stopped. Immutable tokens only vanish by accident or design.

Synthetix’s claw-back and the hacker’s own slip

Synthetix said its protocolDAO had recovered the SNX taken from Binance and moved it into the DAO’s multisignature Safe.

The DAO said that it has notified Binance and would return the tokens on request. The sum that was recovered is about $8.4 million.

The SNX stolen from Binance has been recovered by the Synthetix protocolDAO.

The tokens are secured in the protocolDAO Safe and will be sent back to Binance on request. We have notified Binance.

Fuck Kim Jong Un.https://t.co/Od9S69xuN3

— Synthetix ⚔️ (@synthetix) October 30, 2026

Newton’s tokens survived as a result of the attacker’s own error. The Newton Foundation said that the thief sent about 8 million NEWT straight to the token’s own contract address along with 17 other tokens, including ANIME.

NEWT is an ERC-20 token on Ethereum with a fixed supply of 1 billion. Since the tokens were sent to a contract address that has no function to release them, they became effectively stranded. The amount in question is about $3.5 million in NEWT, and it is now beyond the attacker’s control.

The $2.86 billion no one can touch

The attacker has been converting assets that are freezable into assets that cannot be locked. The bad actors raised about $158.25 million selling altcoins such as AAVE, LINK and PEPE.

The proceeds were then funneled into ETH. The attacker, in another report, supplied 60 million USDT to Aave and borrowed about 19,762 ETH against it. This occurred 41 minutes before Aave froze the market, which was enough time for the attacker to walk away with ETH while the freezable stablecoins stayed behind as collateral.

So far, there are assets worth $2.86 billion of the stolen funds that do not have a freeze function, according to Arkham and Lookonchain tracking.

It comprises $1.09 billion in ETH, $1.41 billion in BTC, and 682.9 million TRX. Binance has suspended deposits and withdrawals, while it says that it would cover user losses from its SAFU reserve and company funds.

Co-CEO Richard Teng wrote on X, “Your money is safe and we’re covering every loss.”