Binance Hackers Converted $6.3B Haul Before Freezes Bit

Attackers behind Binance's estimated $6.3 billion hack still control roughly $3.33 billion in crypto that no issuer can freeze, despite a coordinated industry response that immobilized billions within the first hour, according to on-chain analysis by Elliptic and figures released by Binance on Friday.

The breach, the largest in crypto history, began at 8:04 pm UTC on Thursday. Blockchain analytics link the perpetrators to the same North Korean group behind last month's Bitget hack. Their operational priority was immediate: convert freezable assets such as USDT and USDC into native cryptocurrencies like Bitcoin and Ether that have no central issuer capable of blacklisting addresses.

CertiK engineer Dickson Wu traced $500 million in USDT sent to a single address, with $325 million sold to market makers for ETH by 20:59 UTC — under an hour from the first malicious transaction.

How fast did issuers respond?

Tether froze approximately $1.567 billion in USDT, with the first major freeze executed just 37 minutes after stolen funds reached the attacker's main Ethereum wallet. Circle followed three minutes later, freezing around $823 million in USDC. Ripple and World Liberty Financial also blacklisted associated addresses.

Binance stated Friday that about $3 billion of the stolen assets were frozen on-chain out of an estimated $6.3 billion total, and that it is coordinating with law enforcement, issuers, and blockchain analytics firms to trace additional funds. By 7:00 am UTC Friday, Elliptic put the frozen total at $2.84 billion.

Decentralized infrastructure also acted. Arbitrum's Security Council moved approximately $30.5 million in ARB and ETH into an intermediary frozen wallet, releasable only through further council action or an Arbitrum DAO governance vote.

What does the Aave position change?

The attackers added a DeFi complication. Between 20:58 and 21:01 UTC — about 40 minutes before the first freeze — a wallet tied to the attackers deposited $60 million in USDT into Aave V3 on Ethereum and borrowed $44.6 million in wrapped Ether.

LlamaRisk, an Aave risk service provider, reported in its 1:00 am update that the attacker's position held roughly $59.9 million in USDT collateral against $43.8 million in debt. Because the collateral sits in Aave's lending pool, blacklisting the attacker's wallet cannot automatically retrieve it. Aave Chan Initiative founder Marc Zeller explained: "USDT is real money backed by dollars, and the position is criminal but overcollateralized in the eyes of the protocol."

Aave temporarily froze markets across its V3 and V4 deployments — existing users could still withdraw, repay, and liquidate — before lifting the precautionary freeze after confirming its contracts were unaffected and positions remained overcollateralized. "Just another day in crypto," Zeller said.

How much can the attackers actually keep?

One distinction matters for practitioners: frozen funds are not recovered funds. Freezing prevents suspected attackers from spending assets but does not automatically return them to Binance or its users.

The remaining $3.33 billion, largely converted into BTC and ETH, lacks a centralized issuer with blacklist authority. Transactions can be surveilled and restricted at exchange off-ramps, but on-chain immobilization is largely unavailable.

Binance has pledged to cover all losses through its Secure Asset Fund for Users (SAFU) and company funds, maintaining that user assets are safe. Binance chief executive Richard Teng said the exchange is already "recovering stolen assets for users."

For context, the frozen portion alone — roughly $3 billion — exceeds most previous crypto heists combined, and the unfrozen remnant would still rank among the largest thefts ever recorded. The practical question now is recovery mechanics: how much of the $3.33 billion law enforcement can intercept at custodial touchpoints will define whether this incident ends as a partial or near-total loss.