Billions in Stolen Crypto Remain Untouchable After Record-Breaking Binance Hack

Attackers responsible for the staggering estimated $6.3 billion hack on Binance, the largest in cryptocurrency history, continue to control billions of dollars in stolen digital assets despite concerted efforts by token issuers to freeze the proceeds. The sophisticated operation, which commenced at 8:04 pm UTC on Thursday, has been linked by crypto investigators to the same North Korean hackers previously associated with last month’s Bitget hack. Immediately following the breach, the perpetrators initiated a strategic conversion of assets, aiming to transform readily freezeable cryptocurrencies like USDT and USDC into more elusive ones such as Bitcoin (BTC) and Ether (ETH).

Evidence of this rapid asset movement emerged quickly. CertiK engineer Dickson Wu traced $500 million in USDT sent to a single address, with an astonishing $325 million being sold for ETH to market makers by 8:59 pm UTC, less than an hour after the hack began. This aggressive conversion was a race against time, as some of the crypto industry’s most powerful gatekeepers, including stablecoin giants Tether and Circle, were already enacting measures to blacklist addresses linked to the theft.

Binance confirmed on Friday that approximately $3 billion of the $6.3 billion in stolen assets had been frozen on-chain. The exchange stated it is actively collaborating with law enforcement agencies, token issuers, and blockchain analytics firms to trace the remaining funds. The sheer scale of this theft, even by cryptocurrency standards, is immense. The question remains: with roughly half of the assets immobilized, how much of the stolen cryptocurrency can the perpetrators realistically spend?

The Power of the "Off Switch" in Centralized Cryptocurrencies

The distinction between cryptocurrencies like Bitcoin and Ether, which are decentralized with no single issuer and thus no central authority to halt transactions, and centralized stablecoins like Tether’s USDT and Circle’s USDC, is crucial. The issuers of these stablecoins possess the technical capability to freeze tokens held at specific addresses, a feature that proved instrumental in the immediate aftermath of the Binance hack.

This ability to intervene swiftly allowed for rapid action. Tether reportedly froze a total of approximately $1.567 billion in USDT, with the first significant freeze occurring a mere 37 minutes after the stolen funds reached the attacker’s primary Ethereum wallet. Circle followed suit just three minutes later, freezing around $823 million in USDC. Other issuers, including Ripple and World Liberty Financial, also moved to blacklist compromised addresses.

The capacity to immobilize cryptocurrency assets is not confined solely to stablecoin protocols. Even some decentralized platforms, despite lacking central issuers, took proactive steps. Arbitrum’s Security Council, for instance, transferred approximately $30.5 million in ARB and ETH into an intermediary frozen wallet. These funds can only be accessed through further action by the council or a vote by the Arbitrum DAO governance, demonstrating a decentralized approach to asset security.

It is important to note that frozen funds do not automatically equate to recovered funds. While immobilization prevents suspected attackers from accessing and spending the assets, it does not inherently facilitate their return to Binance or its affected users.

The Aave Complication: Decentralized Lending and Frozen Assets

The decentralized lending protocol Aave introduced an additional layer of complexity to the ongoing recovery efforts. Between 8:58 pm and 9:01 pm UTC, approximately 40 minutes before the first freeze was enacted, a wallet associated with the attackers deposited $60 million in USDT into Aave V3 on the Ethereum network and subsequently borrowed $44.6 million in wrapped Ether (WETH).

LlamaRisk, a risk service provider for Aave, reported in an update at 1:00 am that the attacker’s position was overcollateralized, holding around $59.9 million in USDT as collateral against a $43.8 million debt. Aave stated that this overcollateralization meant the protocol suppliers were not at risk.

Because the USDT had already been deposited into Aave’s lending pool, a simple blacklisting of the attacker’s wallet could not automatically retrieve the collateral held by the protocol. Marc Zeller, founder of Aave Chan Initiative, explained that "USDT is real money backed by dollars, and the position is criminal but overcollateralized in the eyes of the protocol." To prevent further misuse, Aave temporarily froze markets across its V3 and V4 deployments. This precautionary measure allowed existing users to still withdraw funds, repay loans, and liquidate positions. Subsequently, Aave lifted its market freeze across V3 and V4, confirming that its contracts remained unaffected and that all positions continued to be overcollateralized, a situation Zeller wryly described as "just another day in crypto."

The Untouchable Billions: What Remains?

By 7:00 am UTC on Friday, Elliptic estimated that $2.84 billion of the stolen assets had been frozen. This left the attackers with control over approximately $3.33 billion in assets that issuers were unable to immobilize. While this freeze significantly diminished the attackers’ potential profit, it does not guarantee the recovery of all remaining funds.

Bitcoin and Ether, unlike stablecoins, lack a centralized token issuer capable of blacklisting individual addresses. Once stolen assets are converted into these native cryptocurrencies, transactions can be tracked and potentially restricted, but outright freezing becomes considerably more challenging.

Binance has pledged to cover all user losses through its Secure Asset Fund for Users (SAFU) and its own company funds, assuring users that their assets remain secure. In a recent update, Binance CEO Richard Teng stated that the exchange is already "recovering stolen assets for users."