Binance hackers raced to move billions before it could be frozen

The Binance attack began at 8:04 pm UTC Thursday and was estimated at $6.3 billion, making it the largest crypto hack in history. The attackers immediately moved stolen assets because some tokens have issuers that can freeze specific addresses. Speed mattered: every minute gave those issuers more time to block the proceeds.

Their strategy was to swap USDT and USDC, which can be blacklisted, for Bitcoin and Ether, which have no central token issuer. CertiK engineer Dickson Wu traced $500 million in USDT sent to one address. Within 55 minutes, $325 million had been sold to market makers for ETH.

Tether froze about $1.567 billion in USDT, while Circle froze about $823 million in USDC. Binance said roughly $3 billion was frozen onchain, but the attackers still controlled assets that issuers could not immobilize. Frozen funds are blocked, not automatically recovered.

The stolen cryptocurrency was estimated at $6.3 billion, an unprecedented figure even by crypto standards. That total describes the attack’s estimated assets, not necessarily the amount the perpetrators can ultimately spend. Some funds became immobilized soon after the theft, while others were converted into assets without a central issuer.

Binance said about $3 billion of the stolen assets had been frozen onchain. Tether reported freezing around $1.567 billion in USDT, and Circle froze around $823 million in USDC. Arbitrum’s Security Council also moved about $30.5 million in ARB and ETH into an intermediary frozen wallet.

The figures are not directly interchangeable because they come from different statements and estimates. Elliptic estimated that $2.84 billion was frozen by 7:00 am UTC Friday, while attackers still controlled about $3.33 billion in assets issuers could not immobilize. Frozen does not mean recovered.

A centralized stablecoin is a cryptocurrency issued and managed by a company. USDT from Tether and USDC from Circle are examples in the article. Unlike Bitcoin or Ether, these tokens have a central issuer that can respond to incidents. This matters because the issuer has a technical way to immobilize tokens at particular addresses.

The issuer adds an address linked to suspected theft to a blacklist. Once blacklisted, the stablecoins held there cannot be transferred normally through the token’s contract. Tether used this power after the Binance theft, freezing around $1.567 billion in USDT. Circle froze around $823 million in USDC three minutes after Tether’s major freeze.

This mechanism works only on tokens controlled by that issuer. It does not automatically affect Bitcoin or Ether, which lack a central token issuer. It also may not recover tokens already deposited into another protocol, as the Aave example showed. Freezing blocks spending; it does not by itself return funds.

USDT and USDC can be frozen because Tether and Circle control their token systems. Bitcoin and Ether work differently in the article: they are decentralized cryptocurrencies with no central issuer and no single party able to pause individual holdings. Converting stolen stablecoins therefore changes the attackers’ exposure to issuer blacklists.

The hackers used this tactic almost immediately. CertiK engineer Dickson Wu traced $500 million in USDT sent to one address. By 20:59 UTC, just 55 minutes after the hack began, $325 million had been sold to market makers for ETH. That converted part of the proceeds into an asset its issuer could not directly freeze.

This does not make the funds invisible or guaranteed to be usable. Blockchain transactions can still be tracked, and exchanges or other services may restrict activity. But the article states that Bitcoin and Ether cannot be frozen like USDT or USDC. That leaves fewer direct ways to immobilize converted funds.

Depositing stolen USDT into Aave changed where the tokens were held. They were no longer sitting directly in the attacker’s wallet, where an issuer blacklist could target that address. Instead, the USDT became collateral inside Aave’s lending pool, making automatic recovery more complicated.

Between 20:58 and 21:01 UTC, the attackers deposited $60 million in USDT into Aave V3 on Ethereum. They borrowed $44.6 million in wrapped Ether, or WETH. Aave’s risk update later described about $59.9 million in collateral against $43.8 million in debt. The position remained overcollateralized.

Marc Zeller explained that blacklisting the attacker’s wallet could not automatically retrieve collateral held by the protocol. Aave temporarily froze markets to prevent further deposits and borrowing, while allowing withdrawals, repayments, and liquidations. It later lifted that precautionary freeze, saying positions remained overcollateralized and suppliers were not at risk.

Tracking and blocking are different powers. Exchanges, issuers, law enforcement, and analytics firms can follow transactions and identify suspected addresses. But if an asset has no issuer able to freeze it, being watched does not automatically stop its movement. That is why the remaining unfrozen balance mattered.

The attackers converted stablecoins into Bitcoin and Ether, and they also used Aave to borrow WETH against USDT collateral. Bitcoin and Ether do not have a central token issuer that can blacklist individual addresses. Aave’s protocol could restrict activity in its markets, but existing users could still withdraw funds, repay loans, and liquidate positions during the precautionary freeze.

Elliptic estimated that attackers still controlled about $3.33 billion in assets issuers could not immobilize. The article does not specify exactly how much they successfully spent or where they could cash out. It does make clear that tracing, exchange restrictions, and law-enforcement action remained important defenses.

Bitcoin and Ether are decentralized cryptocurrencies, according to the article. Their key distinction is the absence of a central issuer. USDT and USDC have companies that can blacklist addresses, but Bitcoin and Ether do not have an equivalent issuer with authority to freeze individual holdings. That makes direct intervention much harder.

This difference shaped the hackers’ strategy. They raced to exchange freezeable stablecoins for ETH, including $325 million sold by 20:59 UTC. Once assets are held as native Bitcoin or Ether, Tether or Circle cannot simply blacklist the address because those companies do not issue those cryptocurrencies. The network records transactions, but no single issuer controls the tokens.

The absence of an issuer does not mean activity cannot be monitored or restricted elsewhere. The article says transactions can be restricted, and exchanges, law enforcement, and analytics firms were tracing funds. However, it describes Bitcoin and Ether as assets that cannot be frozen like centralized stablecoins, making recovery more difficult.