Binance hackers raced to move billions before freezes
Binance hackers raced to move stolen funds into Bitcoin and Ether after a roughly $6.3 billion breach, converting freezeable stablecoins before Tether and Circle could blacklist wallets. About $3 billion was frozen onchain, yet attackers still control billions issuers cannot immobilize, making this the largest crypto heist on record.
Key Takeaways
- The estimated $6.3 billion Binance breach began at 8:04 pm UTC Thursday and is the largest crypto theft on record.
- Attackers quickly swapped USDT and USDC for assets issuers cannot freeze, including Bitcoin and Ether.
- Binance said about $3 billion of stolen assets were frozen; Elliptic later put freezes near $2.84 billion with roughly $3.33 billion still under attacker control.
- Tether froze about $1.567 billion in USDT and Circle about $823 million in USDC within roughly 40 minutes of funds hitting a main Ethereum wallet.
- Crypto-linked stocks sold off Friday, with Coinbase down more than 13% and Circle more than 9%.
What happened in the Binance breach?
According to Cointelegraph Magazine, perpetrators linked to the same North Korean hackers behind last month’s Bitget hack immediately began converting assets after the attack started.
Their plan was to turn freezeable stablecoins such as USDT and USDC into Bitcoin (BTC) and Ether (ETH). CertiK engineer Dickson Wu traced $500 million in USDT sent to one address, with $325 million sold to market makers for ETH by 20:59 UTC—less than an hour after the hack began.
Binance said Friday that about $3 billion of the stolen assets were frozen onchain out of an estimated $6.3 billion total. The exchange is working with law enforcement, issuers, and blockchain analytics firms, and has pledged to cover losses using its Secure Asset Fund for Users (SAFU) and company funds. CEO Richard Teng said the firm is already recovering stolen assets for users. More breach coverage is in our Fintech & Crypto Alerts hub.
How quickly did Tether and Circle freeze funds?
Centralized stablecoin issuers can blacklist addresses. Tether froze around $1.567 billion in USDT, with the first major freeze just 37 minutes after stolen funds reached the attacker’s main Ethereum wallet. Circle froze about $823 million in USDC three minutes later, with Ripple and World Liberty Financial following soon after.
Arbitrum’s Security Council moved about $30.5 million in ARB and ETH into an intermediary frozen wallet. Immobilizing assets stops spending but does not automatically return funds to Binance or users.
Between 20:58 and 21:01 UTC, a wallet linked to the attackers deposited $60 million in USDT into Aave V3 on Ethereum and borrowed $44.6 million of wrapped Ether—about 40 minutes before the first freeze. Aave said the position stayed overcollateralized, temporarily froze V3 and V4 markets as a precaution, then lifted the freeze.
What can the attackers still spend?
Elliptic estimated that $2.84 billion had been frozen by 7:00 am UTC Friday, while attackers still controlled around $3.33 billion in assets issuers could not immobilize. Bitcoin and Ether lack a central issuer that can blacklist addresses the way Tether or Circle can, so once funds are converted, freezing them is far harder.
How did crypto stocks react to the hack?
A day after the disclosure, crypto-linked equities fell sharply. Coinbase dropped more than 13%, Circle Internet Group (CRCL) more than 9%, and Strategy (MSTR) about 8%, while IREN fell more than 10% and Figure Technology Solutions about 9%, according to market reporting tied to the breach.