Binance hackers raced to move billions before Tether and Circle could freeze the proceeds

The attackers behind Binance’s estimated $6.3 billion hack still control billions of dollars in stolen cryptocurrency, even after issuers and protocols started freezing funds. For PSPs and other high-risk payment operators, the useful detail is not the headline number; it is how fast the criminals tried to rotate frozen assets into coins with no off switch.

1. The attack began at 8:04 pm UTC Thursday and was linked to the same North Korean hackers behind last month’s Bitget hack. The perpetrators immediately started converting assets, with the stated plan of moving funds from tokens that can be frozen, such as USDT and USDC, into assets that cannot be frozen in the same way, such as Bitcoin (BTC) and Ether (ETH).
2. CertiK engineer Dickson Wu traced $500 million in USDT sent to one address, with $325 million sold to market makers for ETH by 20:59 UTC, less than an hour after the hack began. Binance said Friday that about $3 billion of the stolen assets were frozen onchain out of an estimated $6.3 billion total, and that it is working with law enforcement, issuers and blockchain analytics firms to trace additional funds.
3. The freeze mechanics matter. Unlike BTC or ETH, centralized stablecoins such as Tether’s USDT and Circle’s USDC have issuers that can freeze tokens held at specific addresses. Tether froze around $1.567 billion in USDT in total, with the first major freeze happening just 37 minutes after the stolen funds reached the attacker’s main Ethereum wallet. Circle froze around $823 million in USDC three minutes later, and other issuers like Ripple and World Liberty Financial followed soon after.
4. Freezing is not the same as recovery. It stops suspected attackers from spending the funds, but it does not automatically return them to Binance or its users. Arbitrum also moved around $30.5 million in ARB and ETH into an intermediary frozen wallet, where they can only be moved after further action by the council or a vote by Arbitrum DAO governance.
5. The Aave complication adds another layer. Between 20:58 and 21:01 UTC, a wallet associated with the attackers deposited $60 million in USDT into Aave V3 on Ethereum and borrowed $44.6 milli