Hackers Race to Convert Stolen Binance Stablecoins Into Crypto That Cannot Be Frozen

Attackers behind the roughly $6.3 billion Binance hack still control billions in stolen crypto despite freezes by token issuers. The theft began at 8:04 pm UTC Thursday, and the hackers, linked to the same North Korean group behind last month’s Bitget attack, started converting assets right away. Their plan was to swap freezable tokens like USDT and USDC for bitcoin and ether. CertiK engineer Dickson Wu traced $500 million in USDT sent to one address, with $325 million sold to market makers for ETH by 20:59 UTC, less than an hour in.

How Tether and Circle Froze Stolen Stablecoins

Binance says about $3 billion has been frozen onchain. Tether froze around $1.567 billion in USDT, with the first major freeze coming 37 minutes after the funds hit the attacker’s main Ethereum wallet. Circle froze about $823 million in USDC three minutes later, and Ripple and World Liberty Financial followed. Arbitrum’s Security Council also moved about $30.5 million in ARB and ETH into a frozen wallet that needs council action or a DAO vote to release. Frozen funds are not recovered funds, since they are only blocked from being spent.

The Aave Complication

Between 20:58 and 21:01 UTC, an attacker wallet deposited $60 million in USDT into Aave V3 and borrowed $44.6 million in wrapped ether, about 40 minutes before the first freeze. LlamaRisk said the position later held about $59.9 million in collateral against $43.8 million in debt, and Aave said it stayed overcollateralized with no risk to suppliers. Marc Zeller explained that blacklisting the wallet could not pull the collateral out, since the protocol sees the position as sound. Aave briefly froze markets across V3 and V4, then lifted the freeze.