Attackers linked to North Korean hackers moved billions of dollars in stolen cryptocurrency after an estimated $6.3 billion hack tied to Binance, racing to exchange freezeable stablecoins for assets that issuers cannot directly immobilize. The incident has become the largest crypto theft in history, according to reporting by Cointelegraph.
The attack began at 8:04 pm UTC on Thursday. Within minutes, the perpetrators started shifting and converting the stolen assets, as Tether and Circle moved to blacklist addresses connected with the theft.
The strategy was straightforward: sell stablecoins such as Tether’s USDT and Circle’s USDC before their issuers could freeze them, then move the proceeds into Bitcoin (BTC) and Ether (ETH). Unlike centralized stablecoins, Bitcoin and Ether have no single issuer with a direct mechanism to block particular addresses.
CertiK engineer Dickson Wu tracked $500 million in USDT sent to one address. By 20:59 UTC, less than an hour after the attack began, $325 million of that amount had reportedly been sold to market makers in exchange for Ether.
Binance said on Friday that approximately $3 billion of the stolen assets had been frozen onchain, compared with an estimated total of $6.3 billion. The exchange said it was cooperating with law-enforcement agencies, token issuers and blockchain-analytics companies to identify and trace more funds.
Stablecoins provided the first line of containment
USDT and USDC are centralized stablecoins: digital tokens designed to track the value of the US dollar and issued by companies that can intervene in their systems. That centralized structure allows issuers to blacklist specific addresses and prevent tokens held there from being transferred.
Tether said it had frozen about $1.567 billion in USDT in total. Its first major freeze came roughly 37 minutes after stolen funds arrived in the attackers’ main Ethereum wallet. Circle froze approximately $823 million in USDC three minutes later. Other issuers, including Ripple and World Liberty Financial, also took action.
The response was not limited to stablecoin companies. Arbitrum’s Security Council moved about $30.5 million in ARB and ETH into an intermediary frozen wallet. Those assets can be moved only after additional action by the council or a vote through Arbitrum DAO governance.
However, immobilizing tokens is not the same as recovering them. A freeze can stop the suspected attackers from spending assets, but it does not automatically transfer the funds back to Binance or its customers.
Aave position complicated the response
The decentralized lending protocol Aave became involved after an attacker-linked wallet deposited $60 million in USDT into Aave V3 on Ethereum between 20:58 and 21:01 UTC. The wallet then borrowed $44.6 million in wrapped Ether, or WETH, around 40 minutes before the first major freeze.
In an update at 1:00 am, Aave risk service provider LlamaRisk said the position contained roughly $59.9 million in USDT collateral against $43.8 million in debt. Aave said the position remained overcollateralized and did not expose protocol suppliers to risk.
The deposit created a technical distinction. Once the USDT entered Aave’s lending pool, blacklisting the attacker’s original wallet could not automatically retrieve the collateral held by the protocol. The protocol’s accounting treated the collateral as valid even though the associated position was linked to suspected criminal activity.
Aave temporarily froze markets across its V3 and V4 deployments to prevent additional deposits and borrowing. Existing users could still withdraw funds, repay loans and liquidate positions. Aave later lifted the precautionary freeze, saying its contracts were unaffected and positions remained overcollateralized.
What remains under the attackers’ control?
Elliptic estimated that $2.84 billion had been frozen by 7:00 am UTC on Friday, while the attackers still controlled about $3.33 billion in assets that issuers could not immobilize. The freeze therefore reduced the immediately controllable pool, but did not make the remaining cryptocurrency straightforward to recover.
Bitcoin and Ether do not have centralized issuers able to blacklist individual addresses in the same way as Tether or Circle. Their transactions can be monitored and potentially restricted by exchanges or other market participants, but the underlying tokens are much harder to freeze once stolen funds have been converted into them.
Binance has said it will cover losses through its Secure Asset Fund for Users, known as SAFU, and company funds. The exchange also said user assets remain safe. In the latest update cited in the report, Binance chief executive Richard Teng said the exchange was already working to recover stolen assets for users.
Moneyiar market picture
Moneyiar data at 12:38 pm on November 1, 2026, showed Ethereum at $2,259.2691, up 0.39% over 24 hours but down 2.99% over seven days. Tether USDt was priced at $0.998661, down 0.03% in 24 hours and 0.01% over seven days.
BNB stood at $710.822 at the same time, gaining 0.87% over 24 hours while declining 3.77% over seven days. Moneyiar data at 12:39 pm showed STABLE at $0.0265106, up 0.81% over 24 hours and down 0.45% over seven days.
