Binance Hack: $3B Frozen as Attackers Move $6.3B in Stolen Crypto

Attackers behind the reported $6.3 billion Binance hack began moving stolen funds at 8:04 p.m. UTC Thursday, rapidly converting freezable stablecoins into Bitcoin and Ether. CertiK engineer Dickson Wu traced $500 million in USDT sent to one address and found that $325 million had been sold to market makers for ETH by 8:59 p.m. UTC, less than an hour after the attack began. The perpetrators have been linked to the North Korean group implicated in the previous month's Bitget hack.

Binance said Friday that approximately $3 billion of the stolen assets had been frozen on-chain out of an estimated $6.3 billion total. The exchange is working with law enforcement, token issuers and blockchain analytics firms to trace additional funds and identify wallets still holding the proceeds.

Tether and Circle moved quickly to immobilize the stolen stablecoins. Tether froze around $1.567 billion in USDT, with its first major freeze occurring 37 minutes after the stolen funds reached the attackers’ main Ethereum wallet. Circle froze approximately $823 million in USDC three minutes later, while Ripple and World Liberty Financial also blacklisted addresses linked to the theft. Unlike decentralized assets such as BTC and ETH, USDT and USDC have central issuers capable of freezing tokens at specific addresses.

Decentralized protocols also intervened during the race. Arbitrum’s Security Council moved roughly $30.5 million in ARB and ETH into an intermediary frozen wallet, from which the assets can be released only after further review or action. With about half of the reported haul already frozen, investigators are focused on determining how much of the remaining $3.3 billion can still be converted and spent by the attackers.