Attackers behind Binance’s estimated $6.3 billion hack still appear to control billions in stolen crypto after rapidly swapping freezeable tokens into assets such as Bitcoin and Ether. The theft began at 8:04 pm UTC on Thursday, and the movement of funds started almost immediately.
By early Friday, blockchain analytics firm Elliptic estimated that about $2.84 billion had been frozen, leaving roughly $3.33 billion still under the attackers’ control. Binance said it was working with law enforcement, token issuers and analytics firms as efforts to trace and immobilize more of the proceeds continued.
Hackers moved quickly after the breach
The attackers’ apparent strategy was to offload assets that could be blocked by centralized issuers, including USDT and USDC, into cryptocurrencies that do not have an issuer capable of freezing balances. According to the report, about $500 million in USDT was traced to a single address, and $325 million of that was exchanged for ETH within an hour of the hack beginning.
The source article linked the perpetrators to North Korea-affiliated hackers said to be behind last month’s Bitget incident. The Binance theft is described as the largest hack in crypto history, underscoring both the speed of the laundering effort and the difficulty of containing funds once they are converted into decentralized assets.
Blacklists halted part of the stolen funds
Tether and Circle moved to blacklist addresses associated with the theft, helping to lock a large portion of the proceeds on-chain. The report said around $3 billion of the estimated $6.3 billion stolen had been frozen, or roughly half of the total, although work to identify and immobilize additional funds was still underway.
Arbitrum’s Security Council also intervened by moving funds into a frozen intermediary wallet. Even so, freezing tokens does not by itself return assets to Binance or affected users. It mainly prevents further movement while recovery and investigative steps continue.
DeFi routes added another layer of complexity
The attackers also interacted with Aave, where they deposited USDT and borrowed WETH against it. That added complexity to the response because the activity touched a decentralized lending market rather than only direct token transfers.
Aave temporarily froze affected markets to stop further deposits and borrowing. The report said the protocol’s safeguards held and that the freeze was later lifted, while the position remained overcollateralized and was not described as creating immediate losses for lenders.
What Binance says comes next
The biggest unresolved issue is the large share of funds that had already been converted into Bitcoin and Ether by early Friday. Because those assets lack centralized issuers, they are much harder to immobilize than stablecoins once they have moved.
Binance said user assets remain safe and pledged to cover losses using its SAFU fund and company resources. The exchange also said efforts to recover assets for users were already in progress, but the confirmed near-term picture remains that billions have been frozen and billions more are still accessible to the attackers.
Source: cointelegraph.com