Binance Hackers Convert $6.3 B in Stolen Crypto Before Authorities Freeze Assets

The largest crypto‑world theft began at 8:04 pm UTC Thursday when attackers linked to the North Korean group behind last month’s Bitget hack seized roughly $6.3 B in cryptocurrency from Binance. They immediately moved the stolen stablecoins—USDT and USDC, which can be frozen by their issuers—into non‑frozen assets such as BTC and ETH. Within an hour, $500 M of USDT had been sent to a single address, and $325 M was sold for ETH by 20:59 UTC. Stablecoin issuers Tether and Circle, along with other entities, began blacklisting the attackers’ addresses within minutes, freezing about $1.567 B in USDT and $823 M in USDC. Binance reported that around $3 B of the stolen funds were on‑chain frozen, and it is collaborating with law enforcement, issuers and blockchain analytics firms to trace the remaining assets. Decentralized protocols also acted: Arbitrum’s Security Council moved $30.5 M in ARB and ETH into a frozen wallet, and Aave V3 saw a $60 M USDT deposit from an attacker‑linked wallet. While freezing stops the attackers from spending the assets, it does not automatically recover them for Binance or its users.