Binance Hack: $3B Frozen After Attackers Convert $6.3B in Crypto

Attackers behind the estimated $6.3 billion Binance hack converted stolen stablecoins into Bitcoin and Ether to prevent issuers from freezing the funds. The attack began at 8:04 p.m. UTC on Thursday and has been linked to the North Korean group implicated in last month’s Bitget hack. Binance said about $3 billion of the stolen assets had been frozen onchain by Friday.

CertiK engineer Dickson Wu traced $500 million in USDT sent to a single address. By 8:59 p.m. UTC, $325 million had reportedly been sold to market makers in exchange for ETH, less than an hour after the theft began. The rapid conversion gave the attackers an early advantage over stablecoin issuers seeking to blacklist addresses associated with the hack.

Tether froze approximately $1.567 billion in USDT, with its first major freeze occurring 37 minutes after the stolen funds reached the attackers’ main Ethereum wallet. Circle froze around $823 million in USDC three minutes later, while Ripple and World Liberty Financial also froze addresses linked to the incident.

Bitcoin and Ether have no central issuer capable of halting transactions, although decentralized networks can sometimes restrict specific assets. The Arbitrum Security Council, for example, moved about $30.5 million in ARB and ETH into an intermediary wallet where the funds can only be released after further review. Binance is working with law enforcement, token issuers and blockchain analytics firms to trace the remaining assets.