Binance Hack: $2.7B Frozen, but $2.4B Still Out of Reach
Quick Reads
- About $6.36 billion was stolen from Binance on October 29, according to TRM Labs.
- Issuers froze about $2.7 billion, or 42% of the total. Binance says about $3 billion is now frozen.
- The attacker still holds about $2.4 billion in ETH and BTC, which no company can freeze.
- TRM links the attack to North Korea’s TraderTraitor unit. Binance has not named a suspect.
- Past North Korean heists took 10 to 45 days to launder.
- CZ says user funds are safe and expects them to be fully covered.
How much of the Binance hack money is frozen?
The Binance hack has become the largest crypto theft on record, but stealing the money may be the easy part. As of October 30, the attacker held about $2.4 billion in Ether (ETH) and Bitcoin (BTC) that no company can freeze. Turning that into spendable cash is the real challenge,
Blockchain analytics firm TRM Labs estimates the attacker took about $6.36 billion from Binance on October 29. By then, stablecoin issuers and Arbitrum’s Security Council had frozen about $2.7 billion, roughly 42% of the total. In its official announcement, Binance later said about $3 billion was frozen onchain.
Tether froze about 1.77 billion USDT, and Circle froze about 825 million USDC. Ripple and World Liberty Financial added a further $68.3 million.
Binance’s former CEO, Changpeng Zhao (CZ), thanked Tether and Circle for acting quickly. In a post on X, he wrote, “I expect all user funds will be fully covered,” adding that he no longer manages Binance.com but speaks as a shareholder.
Blockworks’ Jason Yanowitz also shared a thread on X with charts showing that stablecoins make up most of the frozen funds.
Why can’t the rest be frozen?
Tether and Circle control their stablecoins and can blacklist wallet addresses. Bitcoin and Ethereum have no administrator who can block a wallet. That is why about 78% of the stolen stablecoins were frozen, while the ETH and BTC remain free. For a deeper look, see AlphaWire’s explainer on the limits of freezing crypto.
The attacker tried to beat the freezes by swapping 325 million USDT for about 122,300 ETH. TRM says this came at a discount of more than 10%, costing around $41 million. It suggests the thief cared more about escaping than about price.
TRM counts more than 420,000 ETH and 18,270 BTC in wallets linked to the attacker. The Bitcoin is being split into smaller chunks of 1,000 BTC and 100 BTC.
Who is behind the attack?
TRM attributes the theft with high confidence to TraderTraitor, an elite North Korean hacking unit. Binance has not named anyone.
Past North Korean heists suggest cashing out takes time. After the Bybit hack in February 2025, TRM reported that all stolen ETH had moved to new addresses within 10 days, and much of it was bridged to Bitcoin. Chainalysis has found laundering cycles of about 45 days after major thefts. It also found that over 60% of North Korean laundering volume moves in transfers below $500,000, so moving $2.4 billion could take thousands of transactions.
Elliptic traced the Bybit funds to the Tron network, where they became USDT and were cashed out through suspected Chinese over-the-counter (OTC) services.
Can the thief actually cash out?
Selling that much on a public exchange would be easy to spot. The 18,270 BTC alone equals about 127% of Binance’s average daily BTC trading volume for October. Bitcoin dropped 5.4% to a low of $76,500 after the outflows began. OTC desks and swap services are the likelier exits.
Those routes are getting riskier. In August, a US appeals court ruled that theft victims can sue Binance over claims that weak controls made it an exit point for stolen assets. Those claims remain unproven. US regulators have also cut Huione Group off from the US financial system, calling it a key node for laundering North Korean hack proceeds.
TRM says the money can only be spent as fast as exits can absorb it, and every exit that screens addresses slows that down. For now, the Binance hack is less about what was stolen and more about whether the thief can use it.
