Binance Hackers Race to Convert $6.3B Stolen Crypto Before Freeze

Attackers behind an estimated $6.3 billion Binance hack immediately began converting stolen assets, seeking to swap freezeable stablecoins for decentralized cryptocurrencies that issuers could not block. The attack began at 8:04 p.m. UTC on Thursday and has been linked to the North Korean hackers implicated in last month’s Bitget hack. Binance said roughly $3 billion of the stolen assets had been frozen onchain by Friday, leaving billions still in the attackers’ hands.

CertiK engineer Dickson Wu traced $500 million in USDT to a single address. By 8:59 p.m. UTC, less than an hour after the attack began, $325 million had been sold to market makers in exchange for ETH. The attackers were also acquiring Bitcoin and Ether, placing their proceeds beyond the direct freeze capabilities of stablecoin issuers such as Tether and Circle, which began blacklisting addresses associated with the theft.

Tether froze approximately $1.567 billion in USDT, with its first major freeze occurring just 37 minutes after the stolen funds reached the attackers’ main Ethereum wallet. Circle froze around $823 million in USDC three minutes later, while Ripple and World Liberty Financial also took action. Decentralized projects can intervene as well: Arbitrum’s Security Council moved about $30.5 million in ARB and ETH into an intermediary frozen wallet, requiring further approval before those assets could be transferred.

Binance said it is working with law enforcement, token issuers and blockchain analytics firms to trace the remaining funds. The exchange previously said it held $5 billion in matching tokens to cover losses from the hack. With roughly half of the stolen assets immobilized, the central question is how much of the remaining crypto attackers can actually spend without exposing themselves to another freeze.