Binance hack: Investigators in a 'cat and mouse game' to recover $6.3 billion in stolen funds

More than $6 billion worth of cryptocurrency was stolen from Binance in a hack attributed by TRM Labs and Chainalysis to TraderTraitor, a North Korean state-backed group. Binance pledged to cover losses through its Secure Asset Fund for Users. The immediate challenge is following and stopping the stolen assets before they disappear into wider financial networks.

Investigators say the hackers are moving quickly. They sold USDT to market makers and borrowed ether against the stablecoin. They also moved funds among wallets and Tron addresses. These steps exploit the fact that some crypto assets can be frozen while others cannot. The hackers are also using professional money-laundering networks to exchange crypto for fiat.

That creates a race against time. Crypto investigators can trace public blockchain transactions, but recovery opportunities decline as funds move farther from their original wallets. Around $3 billion has been frozen, while roughly $3 billion remains at large. Firms are using teams and automated systems to track the money, but the hackers keep changing tactics.

The Binance hack involved more than $6 billion worth of stolen cryptocurrency. That figure represents the overall amount taken from Binance. The scale matters because every transfer creates another opportunity for the hackers to hide the funds, exchange them, or move them into the traditional financial system.

Binance estimates that around $3 billion worth of cryptocurrency has been frozen so far. Stablecoin issuers, including Circle and Tether, moved to freeze some of the stolen tokens. They may also be able to burn those frozen tokens and reissue replacements that can eventually be returned to Binance through a legal government entity.

Roughly $3 billion remains at large, according to the article’s figures. The hackers moved some USDT into market-making arrangements and borrowed ether against it. They also shifted funds across wallets and Tron addresses. The remaining money is therefore harder to seize, especially when it reaches professional laundering networks or assets that issuers cannot freeze.

Stablecoins are digital coins that represent a currency, such as the dollar, at a one-to-one value. They are backed by assets such as government bonds or fiat. Their design makes them useful for moving value while keeping a close link to an established currency. In this case, that design also gives issuers a way to respond to theft.

After the Binance hack, Circle, which issues USDC, and Tether, which issues USDT, moved to freeze some funds. The issuers can effectively destroy frozen stablecoins, making those tokens inaccessible to hackers. They could then reissue new stablecoins for a legal government entity to hold and eventually return to Binance.

This recovery route is not guaranteed. The hackers quickly sold USDT to market makers and borrowed ether against the stablecoin, according to TRM Labs. Ether is harder to freeze. The result was that another entity held the stolen stablecoin, while the hackers had moved into an asset outside the issuers’ direct freezing process.

Crypto transactions appear on public blockchains, so forensic firms can follow funds across online wallets. Hackers try to weaken that advantage by making the movement look complicated. Crypto mixers combine funds from different users, while repeated transfers make investigators follow many linked addresses instead of one clear route.

Chainalysis reported that this case involved laundering patterns it had not seen before. The hackers used automation to send funds back and forth between wallets. Rather than simply moving money onward, they repeatedly circulated it, sometimes sending it back to addresses involved earlier in the sequence. That creates loops and false trails for investigators to analyze.

The transactions remain visible, but visibility does not make interpretation easy. Chainalysis said it was using automated mechanisms as well as teams working around the clock. TRM Labs said investigators are improving at identifying such techniques. Still, every extra transfer can delay tracing and create more opportunities for funds to reach exchanges, market makers, or laundering networks.

Stablecoin issuers such as Circle and Tether can freeze particular tokens. They may also burn frozen tokens and reissue replacements. That gives investigators a possible intervention point while the stolen value remains in USDC or USDT. The opportunity changes when hackers exchange those tokens for other cryptocurrencies.

TRM Labs said the Binance hackers quickly sold USDT to market makers and borrowed ether against the stablecoin. Ether is harder to freeze, so the entity lending it would be left holding the stolen stablecoin. The hackers therefore moved into an asset that could continue circulating without the same issuer action available for stablecoins.

The article also states that bitcoin and ethereum cannot be frozen if hackers swap stablecoins into them. This does not make the funds invisible: blockchain investigators can still track transactions. It does make seizure more difficult. As assets move into harder-to-freeze cryptocurrencies, investigators have fewer direct ways to stop or reverse them.

Professional money-laundering networks help hackers cross from blockchain transactions into the regular financial system. Chainalysis and TRM Labs said hackers are increasingly using Chinese money-laundering organizations. This means investigators may be tracking not only the North Korean group on-chain, but also specialists who handle the conversion process.

The networks can offer to buy stolen cryptocurrency over the counter for a large fee. They then launder the money and return it to the hackers, potentially as stablecoins. Those stablecoins can be exchanged for fiat currency. The arrangement separates the hackers from the people handling the conversion, creating additional layers between the theft and the final cash-out.

Recovery becomes harder as the money moves through these layers. Blockchain investigators may identify the original transfers, but off-chain activity is not recorded on blockchains in the same way. The article notes that seizure opportunities decline the farther funds travel. Once crypto reaches professional networks and fiat channels, tracing alone may not be enough to recover it.

A blockchain is a public ledger of cryptocurrency transactions. It records movements between addresses, allowing crypto forensic firms to track funds across different online wallets. This transparency is why investigators can follow stolen crypto even after hackers move it many times.

On-chain refers to activity recorded on a blockchain. The Binance investigation includes transfers among wallets and Tron addresses, which investigators can analyze. Off-chain refers to activity not recorded on a blockchain. The article gives fiat transactions as an example, because regular currency movements may occur outside the blockchain record.

The distinction matters during cash-out operations. Investigators can follow crypto while it remains on-chain, but their direct visibility changes when professional laundering networks exchange it for fiat. The money may still be connected to earlier blockchain transfers, yet recovery becomes more difficult. As Chainalysis’s Jonathan Levin explained, seizure opportunities decrease as funds move farther from their original path.