The perpetrators behind the catastrophic breach at Binance—an estimated $6.3 billion hack that stands as the largest security incident in the history of the cryptocurrency industry—continue to maintain control over billions of dollars in illicitly obtained digital assets. This despite a coordinated, lightning-fast counteroffensive by token issuers, decentralized finance protocols, and blockchain security researchers to immobilize the stolen proceeds before they could be fully laundered across the wider ecosystem.
The unprecedented cyberattack struck at 8:04 pm UTC on a Thursday evening. Cybersecurity investigators quickly traced the operation to the same North Korean-linked hacking faction responsible for high-profile assaults earlier in the season, most notably the Bitget breach from the previous month. Moving with calculated precision, the perpetrators initiated an immediate and aggressive conversion strategy designed to outrun the digital asset industry’s centralized security mechanisms.
The core game plan for the hackers relied on converting assets equipped with an "off switch"—such as centralized stablecoins like Tether’s USDT and Circle’s USDC—into native, decentralized cryptocurrencies like Bitcoin and Ether, which lack a central authority capable of freezing or reversing transactions. CertiK security engineer Dickson Wu tracked an initial movement of $500 million in USDT funneled directly into a single malicious address. Within less than an hour of the exploit beginning, specifically by 20:59 UTC, approximately $325 million of those stablecoins had already been aggressively sold off to market makers in exchange for Ether.
This frantic asset shuffling triggered a high-stakes race against some of the most powerful infrastructure gatekeepers in the blockchain space. Major stablecoin issuers, including Tether and Circle, immediately mobilized emergency protocols to blacklist addresses associated with the theft, effectively drawing a line in the digital sand to contain the fallout.
By Friday, Binance reported that approximately $3 billion of the estimated $6.3 billion total stolen assets had been successfully frozen on-chain. The exchange confirmed it is actively collaborating with international law enforcement agencies, token issuers, and prominent blockchain analytics firms to trace and intercept the remaining funds. While the sheer scale of the theft remains mind-boggling even by the volatile standards of the cryptocurrency market, the rapid intervention froze roughly half of the stolen capital, raising critical questions about how much of the ill-gotten wealth the perpetrators will ultimately be able to access and spend.
Crypto with an Off Switch
Unlike native, decentralized assets such as Bitcoin and Ether, which operate on permissionless networks with no central issuer and no mechanism to pause transfers, centralized stablecoins function differently. Issuers of tokens like Tether’s USDT and Circle’s USDC retain administrative control capabilities that allow them to freeze tokens held at specific blockchain addresses when criminal activity or regulatory mandates demand it.
This architectural feature provides these centralized entities with the power to act swiftly during major security incidents. Tether moved aggressively during the Binance crisis, ultimately freezing approximately $1.567 billion in USDT. The first major freeze was executed just 37 minutes after the stolen funds first hit the attacker’s primary Ethereum-based wallet.
Circle followed closely behind, freezing roughly $823 million in USDC just three minutes later. Other digital asset issuers, including Ripple and World Liberty Financial, also joined the defensive coalition, blacklisting associated wallets as the scope of the exploit became clear.
The ability to immobilize compromised capital, however, was not restricted exclusively to centralized stablecoin operators. Despite lacking a corporate issuer, certain decentralized protocols and layer-2 networks took proactive measures rather than standing idly by. The Arbitrum Security Council intervened swiftly, moving approximately $30.5 million worth of ARB and ETH into an intermediary frozen wallet. Funds placed in this designated wallet can only be released following further administrative action by the council or a formal governance vote by the Arbitrum DAO.
Industry experts emphasize an important distinction in these scenarios: frozen funds do not automatically equate to recovered funds. While immobilizing assets effectively prevents suspected attackers from spending, cashing out, or moving them further, it does not instantly return the capital to Binance or the users whose funds were impacted.
The Aave Complexities
The involvement of decentralized finance protocols added yet another layer of technical and financial complexity to the unfolding crisis. Between 20:58 and 20:51 UTC, a wallet linked to the attackers deposited $60 million in USDT into Aave V3 on the Ethereum network. From there, the perpetrators borrowed $44.6 million of wrapped Ether (WETH), executing the maneuver roughly 40 minutes before the first wave of stablecoin freezes took effect.
According to an update published at 1:00 am by LlamaRisk, an independent risk service provider for Aave, the attacker’s open position held approximately $59.9 million in USDT collateral against $43.8 million in outstanding debt. Aave representatives confirmed that the position remained overcollateralized throughout the ordeal, ensuring that protocol suppliers and regular users were not put at direct financial risk.
Because the stolen USDT had already been successfully deposited into Aave’s pooled lending markets, simply blacklisting the attacker’s originating wallet was not enough to automatically retrieve the collateral locked inside the smart contract system. Marc Zeller, founder of the Aave Chan Initiative, explained the delicate mechanics of the situation in a public statement, noting that the USDT involved remained legitimate digital dollars backed by reserves, rendering the illicit position technically overcollateralized from the perspective of the protocol’s automated risk parameters.
To prevent further exploitation, such as additional malicious deposits or borrowing loops, Aave temporarily halted markets across its V3 and V4 deployments. During this precautionary pause, existing users retained the ability to withdraw uncompromised funds, repay outstanding loans, and liquidate positions safely. Aave subsequently lifted the temporary freeze across its markets after verifying that smart contracts remained entirely unaffected and that all outstanding debt positions maintained healthy overcollateralization ratios.
Assessing What the Attackers Can Actually Keep
Comprehensive tracking data compiled by blockchain intelligence firm Elliptic estimated that approximately $2.84 billion in stolen assets had been frozen globally by 7:00 am UTC on Friday. This left the attackers in direct control of roughly $3.33 billion in assets that token issuers and administrators could not directly immobilize.
While the rapid enforcement actions cut the attackers’ theoretical profit pool roughly in half, the remaining billions present severe recovery challenges. Because Bitcoin and Ether lack a centralized governing authority capable of blacklisting individual wallet addresses or pausing network activity, converting stolen funds into these native cryptocurrencies shields them from direct administrative freezes. Although blockchain transactions involving BTC and ETH can be monitored and restricted by centralized exchanges upon deposit, freezing them directly at the protocol level remains virtually impossible.
To protect its user base, Binance has pledged to cover all potential shortfalls using capital from its Secure Asset Fund for Users (SAFU) alongside corporate treasury reserves, assuring the public that customer funds remain entirely secure. In a recent public update, Binance Chief Executive Richard Teng confirmed that the exchange’s security teams are actively working around the clock to recover stolen assets and safeguard the platform’s ecosystem moving forward.
