Binance hackers raced to move billions before it could be frozen
Attackers behind Binance’s estimated $6.3 billion hack still control billions of dollars in stolen cryptocurrency despite efforts by token issuers to freeze the proceeds.
The attack, the largest in crypto history, began at 8:04 pm UTC Thursday and the perpetrators, linked to the same North Korean hackers behind last month’s Bitget hack, immediately began converting assets.
The game plan for the hackers was to convert the assets that could be frozen, like USDT and USDC, into ones that could not, such as Bitcoin (BTC) and Ether (ETH).
CertiK engineer Dickson Wu traced $500 million in USDT that was sent to one address, with $325 million sold to market makers for ETH by 20:59 UTC, less than an hour after the hack began.
They were racing against some of crypto’s most powerful gatekeepers: stablecoin giants like Tether and Circle, who had already begun blacklisting addresses associated with the theft.
Binance said Friday that about $3 billion of the stolen assets were frozen onchain out of an estimated $6.3 billion total, and that it is working with law enforcement, issuers and blockchain analytics firms to trace additional funds.
The scale of the theft is mind-boggling, even in crypto terms, but with around half of the assets already frozen, how much of the stolen crypto can the perpetrators actually spend?
Crypto with an off switch
Unlike BTC or ETH, which are decentralized cryptocurrencies with no central issuer and no one to hit the pause button, centralized stablecoins like Tether’s USDT and Circle’s USDC have issuers that can freeze tokens held at specific addresses.
Binance said it is working with law enforcement to trace the funds. Source: Binance
That gives them the power to act swiftly in incidents like these. Tether froze around $1.567 billion in USDT in total, with the first major freeze happening just 37 minutes after the stolen funds reached the attacker’s main Ethereum wallet.
Related: Binance says it holds $5B in matching tokens to cover hack losses
Circle froze around $823 million in USDC three minutes later, with other issuers like Ripple and World Liberty Financial following soon after.
The ability to immobilize crypto is not exclusively a stablecoin feature, and despite not having central issuers, some decentralized protocols like Arbitrum did not sit idly by.
Arbitrum’s Security Council moved around $30.5 million in ARB and ETH into an intermediary frozen wallet, where they can only be moved after further action by the council or a vote by Arbitrum DAO governance.
One important distinction remains — frozen funds don’t necessarily equate to recovered funds. Immobilizing assets prevents the suspected attackers from spending them, but it doesn’t automatically return them to Binance or its users.
The Aave complication
Decentralized lending protocol Aave adds another layer of complexity to the equation. Between 20:58 and 21:01 UTC, a wallet associated with the attackers deposited $60 million in USDT into Aave V3 on Ethereum and borrowed $44.6 million of wrapped Ether (WETH), around 40 minutes before the first freeze.
LlamaRisk, an Aave risk service provider, said in its 1:00 am update that the attacker’s position subsequently held around $59.9 million in USDT collateral against $43.8 million in debt. Aave said the position remained overcollateralized and did not put protocol suppliers at risk.
Largest crypto heists of all time. Source: Elliptic
Since the USDT had already been deposited into Aave’s lending pool, blacklisting the attacker’s wallet could not automatically retrieve the collateral held by the protocol, as Aave Chan Initiative founder Marc Zeller explained:
“USDT is real money backed by dollars, and the position is criminal but overcollateralized in the eyes of the protocol.”
To prevent further deposits and borrowing, Aave temporarily froze markets across its V3 and V4 deployments, although existing users could still withdraw funds, repay loans and liquidate positions.
Aave later lifted its precautionary freeze across V3 and V4 markets, saying its contracts were unaffected and positions remained overcollateralized.
“Just another day in crypto,” Zeller said.
So what can the attackers actually keep?
Elliptic estimated that $2.84 billion had been frozen by 7:00 am UTC on Friday, while the attackers still controlled around $3.33 billion in assets that issuers could not immobilize.
And while the freeze almost halved the attackers’ profit pool, that doesn’t mean all the remaining funds are safe to recover.
Bitcoin and Ether don’t have a centralized token issuer that can blacklist individual addresses like Tether or Circle. So once stolen assets are converted into these native cryptocurrencies, transactions can be restricted, but freezing them is a lot harder.
Binance has pledged to cover all losses using its Secure Asset Fund for Users (SAFU) and company funds, and says user assets remain safe; according to the latest update from Binance chief executive Richard Teng, the exchange is already “recovering stolen assets for users.”
Magazine: Cybersecurity’s Black October: How to protect yourself