Binance Hack: How Attackers Raced to Move $6.3B
Ecosystem
English
News
Latest News
Bitcoin Ethereum Altcoins Blockchain Regulation Markets Features
Magazine
Reviews Research Opinion Podcasts Newsletters Commissioned Articles Press Releases Special Projects
About
About Cointelegraph History of Cointelegraph Editorial Policy Ads Disclosure Financial Risk Disclaimer
- DOGE: $0.07544 (1.30%)
- TRX: $0.3255 (3.93%)
- LINK: $11.41 (2.54%)
- ZEC: $1,262.11 (1.08%)
- ADA: $0.1931 (0.54%)
- XRP: $1.24 (1.42%)
- ETH: $2,242.16 (0.33%)
- BTC: $77,223.26 (1.76%)
- XMR: $597.46 (1.07%)
- BNB: $703.77 (1.76%)
- XLM: $0.1690 (1.17%)
- SOL: $95.78 (2.47%)
- HYPE: $88.02 (5.72%)
Written by:
- Christina Comben
- staff editor
Edited by:
- Bryan O'Shea
- staff editor
Binance hackers raced to move billions before it could be frozen
Magazine
Published:
Oct 30, 2026
Attackers behind Binance’s estimated $6.3 billion hack still control billions of dollars in stolen cryptocurrency despite efforts by token issuers to freeze the proceeds.
The attack, the largest in crypto history, began at 8:04 pm UTC Thursday. The perpetrators, linked to the same North Korean hackers behind last month’s Bitget hack, immediately began converting assets.
Their game plan: convert assets that could be frozen, like USDT and USDC, into ones that could not, such as Bitcoin (BTC) and Ether (ETH).
CertiK engineer Dickson Wu traced $500 million in USDT that was sent to one address, with $325 million sold to market makers for ETH by 20:59 UTC, less than an hour after the hack began.
They were racing against powerful gatekeepers: stablecoin giants like Tether and Circle, who had already begun blacklisting addresses associated with the theft.
Binance said Friday that about $3 billion of the stolen assets were frozen onchain out of an estimated $6.3 billion total, and that it is working with law enforcement, issuers, and blockchain analytics firms to trace additional funds.
While half of the assets are already frozen, how much of the stolen crypto can the perpetrators actually spend?
Crypto with an off switch
Unlike BTC or ETH, centralized stablecoins like Tether’s USDT and Circle’s USDC have issuers who can freeze tokens held at specific addresses.
Binance said it is working with law enforcement to trace the funds.
Source: Binance
Tether froze around $1.567 billion in USDT in total, with the first major freeze happening just 37 minutes after the stolen funds reached the attacker’s main Ethereum wallet. Circle froze around $823 million in USDC three minutes later, with other issuers like Ripple and World Liberty Financial following soon after.
Even decentralized protocols like Arbitrum took action, moving around $30.5 million in ARB and ETH into an intermediary frozen wallet.
One important distinction: frozen funds don’t necessarily mean recovered funds. Immobilizing assets prevents suspected attackers from spending them, but it doesn’t automatically return them to Binance or its users.
The Aave complication
Decentralized lending protocol Aave adds another layer of complexity. Between 20:58 and 21:01 UTC, a wallet associated with the attackers borrowed $240 million in ETH from Aave, further complicating the recovery process.