Binance hackers raced to move billions before it could be frozen

Attackers behind Binance’s estimated $6.3 billion hack still control billions of dollars in stolen cryptocurrency despite efforts by token issuers to freeze the proceeds.

The attack, the largest in crypto history, began at 8:04 pm UTC Thursday and the perpetrators, linked to the same North Korean hackers behind last month’s Bitget hack, immediately began converting assets.

The game plan for the hackers was to convert the assets that could be frozen, like USDT and USDC, into ones that could not, such as Bitcoin (BTC) and Ether (ETH).

CertiK engineer Dickson Wu traced $500 million in USDT that was sent to one address, with $325 million sold to market makers for ETH by 20:59 UTC, less than an hour after the hack began.

They were racing against some of crypto’s most powerful gatekeepers: stablecoin giants like Tether and Circle, who had already begun blacklisting addresses associated with the theft.

Binance said Friday that about $3 billion of the stolen assets were frozen onchain out of an estimated $6.3 billion total, and that it is working with law enforcement, issuers and blockchain analytics firms to trace additional funds.

The scale of the theft is mind-boggling, even in crypto terms, but with around half of the assets already frozen, how much of the stolen crypto can the perpetrators actually spend?