The attackers in the $6.3 billion Binance theft have started to split their haul along the lines of assets that can be frozen or potentially clawed back and assets beyond freeze controls.
On one hand, stablecoin issuers are already pulling blacklist and freeze levers, while the hackers are racing to cross over to ETH, BTC and other tokens with no issuers or off switches.
The scramble to wall off tokens before they cross into unrecoverable territory follows what has been described as the biggest theft in crypto history, which, ironically, hit the world’s largest crypto exchange.
Binance’s initial report of the incident has blamed the exploit on a compromised DevOps engineer’s laptop.
What has been frozen from the Binance hack?
The Binance attackers, whom TRM Labs and Chainalysis have, with high confidence, fingered as North Korea’s TraderTraitor unit, have lost nearly $3 billion of the tokens they moved from the exchange.
The issuers of the largest stablecoins by market cap, Tether and Circle, have both blacklisted about 1.77 billion USDT and 825 million USDC, respectively, according to TRM Labs.
Of the stolen 88.5 million RLUSD stablecoin, Ripple has frozen 40.5 million, while Trump-linked World Liberty Financial has locked 27.8 million of its USD1 token.
Arbitrum’s Security Council also pulled a lever that helped it stop $30.5 million.
However, the North Korea-linked attackers still have almost $3 billion that no entity can touch, per Arkham and Lookonchain tracking: roughly $1.09 billion in ETH, $1.41 billion in BTC and 682.9 million TRX.
The attacker raised $158.25 million from selling altcoins like AAVE, ENA, LINK, PEPE and UNI. All of that money has since been converted into Ethereum, a non-freezable asset.
Who can intervene and who can’t?
DEX aggregator 1inch and the Reserve protocol present a side-by-side comparison of the intervention bridge that the hackers are looking to cross.
1inch said exploit-linked addresses have already been blocked from accessing its dApp, wallet and API. It also said it has reached out to Binance to offer help and is coordinating with ZeroShadow, SEAL 911 and TRM Labs.
Reserve, on the other hand, could not do anything to stop the attackers when they swept up about 3.4 billion of its RSR token. The team wrote on X that “no one, including us, can freeze” the tokens because RSR is immutable and has no admin keys.
Arbitrum’s Security Council temporarily modified the network’s inbox contract on Ethereum, added a function to reproduce a cross-chain transaction while impersonating the exploit address, and moved 8,425 ETH and 74,559,805 ARB into a holding wallet ending in 0DA0, according to the Arbitrum governance forum.
The council then restored the contract. The funds can only move after an ArbitrumDAO vote.
The council used the same emergency powers in April, when it froze about 30,766 ETH, worth roughly $71 million, tied to the KelpDAO exploit.
What the Bitget hack already showed
Frozen is not recovered, and the industry has fresh proof of how little freezing can catch once an attacker converts. In the September Bitget breach, Cryptopolitan reported that Circle and Tether locked just $318,000 out of $387.5 million stolen, because the thief had already swapped the rest into Ether.
Bitquery data cited by Cryptopolitan shows wallets frozen within a week keep 59% of their USDT after a week but only 12% after six months.
Binance has suspended deposits and withdrawals, pledged to cover user losses from its SAFU reserve and company funds, and expects withdrawals to resume within 48 hours.
Co-CEO Richard Teng wrote on X, “Your money is safe and we’re covering every loss.” The exchange has not said how much of the frozen $3 billion it can actually reclaim, or what will happen to the remaining $3.3 billion.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.