Attackers linked to North Korean hacking groups executed the largest cryptocurrency theft in history, stealing an estimated $6.3 billion from Binance. The breach began at 8:04 pm UTC on Thursday, with perpetrators immediately converting freezeable stablecoins like USDT and USDC into decentralized assets such as Bitcoin and Ether to evade recovery. CertiK engineer Dickson Wu traced $500 million in USDT sent to a single address, noting that $325 million was sold for ETH within an hour of the attack.
Stablecoin issuers Tether and Circle acted swiftly to blacklist addresses associated with the theft. Tether froze approximately $1.567 billion in USDT, with its first major action occurring just 37 minutes after funds reached the attacker’s main Ethereum wallet. Circle followed shortly after, freezing around $823 million in USDC. Other entities, including Ripple, World Liberty Financial, and Arbitrum’s Security Council, also immobilized significant portions of stolen assets. By Friday morning, Elliptic estimated that $2.84 billion had been frozen, while attackers retained control of roughly $3.33 billion in assets that could not be centrally blocked.
The incident complicated decentralized finance protocols, particularly Aave. Attackers deposited $60 million in USDT into Aave V3 and borrowed $44.6 million in wrapped Ether before the initial freezes. Although the position remained overcollateralized, Aave temporarily froze markets across its V3 and V4 deployments to prevent further exploitation, later lifting these restrictions. Binance stated it is working with law enforcement and blockchain analytics firms to trace remaining funds and pledged to cover user losses through its Secure Asset Fund for Users (SAFU) and company reserves.
This event underscores the critical vulnerability of centralized exchanges to sophisticated state-sponsored attacks and highlights the operational limits of on-chain freezing mechanisms. While stablecoin issuers demonstrated rapid response capabilities by immobilizing billions in dollars worth of tokens, the conversion of assets into Bitcoin and Ether created an irrecoverable loss pool for those specific holdings. The distinction between frozen and recovered funds remains stark; preventing expenditure does not guarantee restitution to victims or platforms.
The involvement of DeFi protocols like Aave introduces complex systemic risks. Although the protocol avoided direct insolvency due to overcollateralization, the temporary market freezes illustrate how centralized interventions can disrupt decentralized infrastructure during high-stakes security incidents. This case may accelerate regulatory scrutiny on exchange custody practices and force a reevaluation of how quickly cross-chain bridges and lending pools must react to blacklisted addresses to mitigate contagion effects.
