The hackers who took about $6.3 billion from Binance on Thursday are now in a race against the companies that can freeze stolen money, according to blockchain tracking firm Chainalysis.
Some stolen coins are easy to freeze. Stablecoins like USDT and USDC are issued by companies, Tether and Circle, which can lock tokens at a flagged address. Bitcoin and ether have no company in charge, so no one can freeze them that way. That difference is shaping how the attackers move the money.
What Chainalysis says the hackers are doing. In a post on X Saturday morning, Chainalysis said the attackers have been parking stablecoins on the Tron blockchain in DeFi lending apps. In return they get a “receipt” token, a claim on the coins in the pool. Unlike the stablecoins themselves, those receipt tokens can’t be frozen. The attackers send the receipts to fresh wallets with no link to the hack, trade them back for stablecoins, and then bridge the money to Ethereum as ether. Chainalysis walked through one $500,000 example step by step. It said Circle and Tether have contributed to $2.8 billion in freezes so far.
In its write-up of the hack, Chainalysis also said the attackers swapped $325 million in stablecoins for $285 million in ether in about 20 minutes on Thursday, before freezes started at 5:14 p.m. ET. It said the laundering shows signs of automation, with thousands of transactions in a short time. Chainalysis attributes the theft to North Korea’s TraderTraitor group, and TRM Labs and Elliptic have also pointed to North Korea. No government agency has made an official attribution, and Binance has not named a culprit.
Tools for everyone else. Elliptic said Saturday that its public blocklist of addresses tied to the hack now holds more than 2,800 addresses and is free to check. It warned that the attacker is still moving funds.
Where Binance stands. Withdrawals are still paused. Binance’s second incident update, posted Friday afternoon, said it has set aside more than $6.34 billion and already holds about $5 billion of it in the same tokens that were taken, roughly 80% of the loss. It is buying the rest. About $3 billion has been frozen on-chain with partners, Binance said. The exchange is targeting a phased restart of withdrawals in about 34 hours from that update, which works out to the early hours of Sunday, ET, subject to security checks. It also planned a first proof-of-reserves snapshot within 12 hours, with results due by Monday, Nov. 2. As of Saturday morning, Binance had not said publicly whether that snapshot was taken. Its support account is still telling customers that withdrawals will resume “as soon as the security issue is fully resolved.”
Market check. U.S. spot bitcoin ETFs saw a net $643.2 million in outflows on Friday, the first full trading day after the hack, according to Farside Investors. BlackRock’s IBIT lost $233.7 million and Fidelity’s FBTC lost $201 million. Prices were calm Saturday morning. At about 8:20 a.m. ET, CoinGecko showed bitcoin near $77,500, ether near $2,246, XRP near $1.25 and BNB near $704, each within about 1% of where they were a day earlier.
The next checks are clear: whether withdrawals actually reopen this weekend, what the reserve report shows on Monday, and when Binance publishes its technical post-mortem.
Sources: Chainalysis on X, Chainalysis, Elliptic on X, Binance, Binance on X, CoinDesk, Farside Investors, CoinGecko.