The hacker behind the $6.3 billion Binance exploit moved swiftly on-chain to convert centralized stablecoins into freeze-resistant crypto assets such as Ether (ETH) and Bitcoin (BTC). The scramble to move funds unfolded before stablecoin issuers could lock the attacker’s primary wallets.
CertiK security engineer Dickson Wu tracked the transfer of 500 million USDT to an address controlled by the hacker. From those funds, 325 million USDT was sold to market makers in exchange for ETH in less than an hour following the attack, precisely at 20:59 UTC. This swift maneuver outpaced stablecoin issuers, who began blacklisting the hacker’s wallets just tens of minutes later.
Swapping $325 Million Within an Hour of the Attack
Tether froze approximately $1.567 billion in USDT within the first 37 minutes after the stolen funds reached the hacker’s primary Ethereum wallet. Three minutes later, Circle followed suit by freezing $823 million in USDC at the same address.
Around 40 minutes before stablecoin issuers executed their first freeze, the hacker had already deposited $60 million in USDT into the Aave V3 lending protocol on Ethereum. Using that collateral, the attacker borrowed $44.6 million in Wrapped Ether (WETH).
Aave governance responded by freezing markets across V3 and V4 deployments as an emergency mitigation measure to prevent the hacker from supplying additional collateral or taking out further loans. Concurrently, the Arbitrum Security Council executed an emergency transaction to freeze approximately $30.5 million in ARB and ETH tokens held by the hacker into a dedicated intermediate wallet controlled by the DAO multisig.
Why Collateral on Aave Isn’t Automatically Returned
Blacklisting the hacker’s wallet address does not automatically recover funds that have entered lending protocols. Data from LlamaRisk indicates that the hacker’s position on Aave held $59.9 million in USDT collateral against $43.8 million in outstanding debt obligations.
Aave Chan Initiative founder Marc Zeller explained that the collateral remains locked within the liquidity pool. According to Zeller, blacklisting the attacker’s wallet does not automatically return the collateralized assets to Binance, as the funds are bound by the protocol’s pooling mechanism.
The Remaining $2.4 Billion That Cannot Be Frozen
Of the total stolen funds, estimated between $6.3 billion and $6.4 billion, approximately $3 billion in assets has now been frozen on-chain. This figure updates initial reports that previously recorded $2.5 billion in frozen funds.
Centralized issuers and network operators have frozen roughly half of the stolen proceeds, yet the attacker retains an untouched portion. The hacker still holds more than 420,000 ETH and 18,270 BTC - valued at around $2.4 billion - which are impossible for centralized issuers to freeze.
For exchanges and law enforcement, minutes on the blockchain proved decisive: approximately $3 billion in stablecoins was frozen through issuer blacklists, but the remaining $2.4 billion in ETH and BTC remains in the hacker’s hands as long as they retain control of the private keys.
Reported via Cointelegraph.
Read also: How Crypto Staking Works and Its Risks
Previously: Binance Hot Wallet Drained of Up to $5.8 Billion via EIP-7702 - Stablecoin Issuers Freeze $2.5 Billion
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
