Hackers behind an estimated $6.3 billion Binance theft moved quickly to convert stolen assets into cryptocurrencies that cannot be easily frozen, even as major stablecoin issuers mobilized to blacklist addresses linked to the attack.
The hack began at 8:04 pm UTC Thursday. According to blockchain analysis, perpetrators immediately started converting assets, with $500 million in USDT reaching a single attacker address and $325 million exchanged for Ether within an hour.
The Race to Freeze Assets
Tether and Circle, the issuers of USDT and USDC respectively, acted swiftly to immobilize the stolen funds. Tether froze approximately $1.567 billion in USDT, with the first major freeze occurring 37 minutes after the stolen funds reached the attacker's primary Ethereum wallet. Circle followed three minutes later with a freeze of around $823 million in USDC.
Other protocols joined the effort. Arbitrum's Security Council moved approximately $30.5 million in ARB and ETH into an intermediary frozen wallet. By 7:00 am UTC Friday, Elliptic estimated that $2.84 billion in stolen assets had been frozen.
The Limits of Freezing
Frozen funds do not automatically mean recovered funds. Bitcoin and Ether, which lack central issuers, cannot be frozen in the same way as stablecoins. Once assets are converted into these native cryptocurrencies, transactions can be restricted but immobilizing them proves significantly more difficult.
The attackers still controlled approximately $3.33 billion in assets that issuers could not immobilize as of Friday morning.
The Aave Complication
Between 20:58 and 21:01 UTC, an attacker wallet deposited $60 million in USDT into Aave V3 and borrowed $44.6 million in wrapped Ether. Aave temporarily froze its V3 and V4 markets as a precaution but later lifted the freeze after determining positions remained overcollateralized and did not threaten protocol suppliers.
Binance has pledged to cover all losses using its Secure Asset Fund for Users and company funds. According to the exchange's chief executive Richard Teng, the company is already recovering stolen assets for users.
