Nearly Half of Binance's $6.3B Stolen Assets Frozen as Hackers Swap Holdings Before Blockades Hit

Binance discloses $6.3B loss, $3B frozen

Binance disclosed that an attack beginning Thursday (2026-10-29) at 20:04 UTC is estimated to have caused about $6.3 billion in asset losses, of which roughly $3 billion has been frozen on-chain. Binance said it is working with law enforcement, stablecoin issuers and on-chain analytics firms to trace the remaining funds. By its account, this is the largest attack in crypto industry history.

North Korea-linked group suspected

The attackers are linked to the North Korea-backed hacking group behind last month's Bitget incident. According to tracking by CertiK engineer Dickson Wu, about $500 million in USDT was transferred to the same address, of which $325 million was sold to market makers for ETH by 20:59 UTC — less than an hour after the attack began. The attackers' approach was to convert assets that issuers can freeze, such as USDT and USDC, into assets with no central issuer, such as Bitcoin and ETH, as quickly as possible.

Issuers move to block funds

The issuers' blockades followed quickly: Tether froze a cumulative ~$1.567 billion in USDT, with the first large freeze occurring 37 minutes after the stolen funds entered the attacker's main Ethereum wallet; Circle froze ~$823 million in USDC three minutes later, and Ripple and World Liberty Financial followed. Arbitrum's Security Council moved about $30.5 million in ARB and ETH into an intermediate freeze wallet, which requires further council action or a DAO governance vote before the funds can be moved.

Frozen is not recovered

A distinction is needed: freezing does not equal recovery. Locking the assets only prevents the attackers from spending them; it does not automatically return them to Binance or its users.

Source: https://cointelegraph.com/magazine/binance-hackers-raced-to-move-billions-before-could-be-frozen?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound