Binance Hackers Still Control $3.33 Billion, Race to…
Blockchain analytics firm Elliptic verified $2.84 billion in frozen assets as of 7:00 a.m. UTC on October 30, representing approximately 44% of its $6.43 billion estimate of the theft. Binance separately reported that approximately $3 billion had been frozen and said it was working with law enforcement to recover additional funds.
The incident, which began on October 29, is the largest cryptocurrency theft on record. Binance has pledged to absorb customer losses, but the amount immobilized on-chain remains substantially different from the amount actually recovered.
Why Could Stablecoin Issuers Freeze Only Part of the Theft?
Centralized stablecoins such as USDT and USDC allow their issuers to blacklist specific addresses, preventing holders from transferring the affected tokens. That capability became a critical defense during the Binance attack, as Tether, Circle and other issuers moved to restrict stolen assets.
Tether froze approximately $1.567 billion in USDT, with its first major intervention occurring 37 minutes after the tokens arrived in the attacker’s principal Ethereum wallet. Circle subsequently froze approximately $823 million in USDC.
The interventions expanded the initial stablecoin freezes involving Tether, Circle and Ripple, with additional actions by other token issuers and the Arbitrum Security Council.
According to Elliptic, stablecoins represented 94% of the assets successfully frozen. However, attackers converted approximately $786 million in stablecoins into ETH and TRX before the restrictions took effect.
On Ethereum alone, approximately 434 million USDT was exchanged for 160,451 ETH through decentralized exchanges and market makers. Some transactions involved discounts of 12% to 26% against prevailing market prices, suggesting that avoiding freezes took priority over maximizing proceeds.
Investor Takeaway
Issuer-controlled freezes can contain thefts involving centralized tokens, but rapid conversion into native cryptocurrencies sharply reduces that protection.
How Did the Attackers Exploit Aave’s Lending Infrastructure?
The attackers also used decentralized lending to obtain cryptocurrency without directly selling all their stablecoin holdings.
Between 20:58 and 21:01 UTC on October 29, an attacker-linked wallet deposited approximately $60 million in USDT into Aave V3 on Ethereum and borrowed 19,762 wrapped Ether, worth roughly $44.6 million at the time.
The transactions occurred approximately 40 minutes before the first relevant market freeze. By the following morning, the position held approximately $59.9 million in USDT collateral against $43.8 million in outstanding debt.
LlamaRisk, an Aave risk service provider, confirmed that the position remained overcollateralized and did not endanger protocol suppliers.
The arrangement exposed a limitation of blacklisting. Once USDT entered Aave’s lending pool, freezing the originating wallet did not automatically return the collateral or reverse the ETH loan.
Aave temporarily froze lending markets across its V3 and V4 deployments to prevent new deposits and borrowing, while existing withdrawals, repayments and liquidations remained available. The protocol subsequently reopened those markets on October 30, reporting that its contracts were unaffected.
What Does Binance’s $6.34 Billion Recovery Commitment Mean?
Binance has set aside more than $6.34 billion in company funds to cover the estimated theft, including approximately $5 billion already held in the same categories of cryptocurrency that were stolen.
The exchange said it was acquiring the remaining replacement assets through market and over-the-counter transactions. Its commitment to replenish customer holdings is separate from efforts to recover cryptocurrency still controlled by the attackers.
Meanwhile, investigations into the attack’s authorization mechanism have identified the use of Ethereum’s EIP-7702 functionality to delegate control of a Binance wallet to malicious code.
Binance initially pointed to a compromised employee laptop but subsequently acknowledged additional points of intrusion. It said investigators had found no evidence of leaked wallet private keys, although the complete attack sequence remained under investigation.
The exchange also temporarily suspended withdrawals while conducting security checks. Binance plans to publish an updated Proof of Reserves report by November 2, providing a more detailed basis for assessing its replacement of affected customer assets.
Investor Takeaway
Binance’s financial backstop protects customer claims if fulfilled, but replenishing reserves does not mean stolen funds have been recovered.
Can Investigators Recover the Remaining $3.33 Billion?
Elliptic identified approximately $3.33 billion in assets beyond direct issuer freezing, distributed across roughly 43 addresses. The holdings included 18,270 BTC, more than 511,000 ETH and substantial balances in XRP, TRX and other cryptocurrencies.
Unlike centralized stablecoins, native Bitcoin and Ether cannot be immobilized through an issuer blacklist. Investigators can trace their movements, but preventing liquidation generally requires cooperation from exchanges, custodians and other intermediaries.
The attackers have already demonstrated their willingness to absorb trading losses to escape centralized-token restrictions, including through large altcoin conversions into Ether.
Elliptic identified possible links to North Korean hacking operations, including connections with wallets associated with the earlier Bitget exploit. Attribution remains an investigative assessment rather than a publicly established finding.
The next phase will depend on whether authorities can intercept the remaining assets before they pass through additional wallets and trading services. Although nearly half the theft has been immobilized, recovering the rest requires tools that extend beyond the freezing powers of stablecoin issuers.
