Around $3 billion has been frozen, according to Binance, but investigators face a harder task as stolen assets move through wallets and professional laundering networks.
MARKET INSIDER — Investigators pursuing approximately $6.3 billion stolen from Binance face a challenge that goes beyond identifying suspicious wallets: securing the assets before attackers convert or transfer them beyond their reach. Binance estimates that around $3 billion has been frozen, creating a potential route to recover part of the losses. The remaining funds are harder to secure as investigators track transfers across blockchains and intermediaries. For customers and investors, three distinctions matter: tracing money does not guarantee its recovery, frozen assets have not necessarily been returned, and Binance’s compensation pledge is separate from the investigation.
Key Highlights
- Binance estimates around $3 billion has been frozen following the theft, but recovery remains subject to further action.
- TRM Labs and Chainalysis attribute the attack to North Korea-linked TraderTraitor, according to CNBC.
- Investigators say automated wallet transfers and professional laundering networks are complicating efforts to recover the remaining assets.
Stablecoin freezes offer a potential recovery route
Stablecoin issuers have become central to the response. Circle and Tether, which issue USDC and USDT respectively, moved to immobilize tokens associated with the attack.
Unlike native cryptocurrencies such as bitcoin, centrally issued stablecoins can include controls that allow their issuers to block transfers from designated addresses. Those controls can prevent suspected attackers from spending the affected tokens while investigators establish what happened.
Freezing, however, is an intermediate step.
One potential recovery process involves issuers destroying the frozen tokens and creating replacements that can be placed into lawful custody before being returned to Binance. Whether that happens depends on the issuers’ procedures and the applicable legal arrangements.
The approximately $3 billion freeze estimate therefore represents progress in restricting access to assets. It should not be described as money already recovered by the exchange or distributed to customers.
Attackers anticipated intervention
According to TRM Labs’ account to CNBC, the attackers moved quickly to exchange some USDT through market makers and obtain ether against stablecoin collateral.
These transactions illustrate how exposure can spread beyond the original victim. A counterparty may receive tokens that are subsequently frozen, while the attacker obtains another asset that lacks the same issuer controls.
The distinction is particularly relevant for trading firms and lending platforms. Accepting an asset at its market value does not eliminate the possibility that its provenance will later make it unusable.
TRM separately estimated that approximately $6.36 billion left Binance wallets across 10 blockchains, largely within about 20 minutes, and attributed the attack to North Korean hackers. That remains an attribution by the investigative firm. (reuters.com)
A visible transaction trail can still be difficult to follow
Public blockchains give investigators an enduring record of transactions. But a visible record does not automatically identify the person controlling a wallet or provide authority to seize its contents.
Chainalysis chief executive Jonathan Levin told CNBC that investigators had observed automated transfers repeatedly circulating funds among addresses, sometimes returning them to wallets used earlier.
Such activity can complicate analysis by multiplying the transactions investigators must examine. It does not erase the underlying records.
Although cryptocurrency mixers are often associated with attempts to conceal stolen funds, Levin said investigators had not observed their use in this case at the time of the interview.
He also described substantial movements to addresses on the Tron blockchain. Using a particular network is not itself evidence of wrongdoing; the relevant issue is how identified proceeds move through it.
Native bitcoin and ether generally lack a central issuer that can blacklist holdings. Recovery can nevertheless remain possible if funds reach a cooperative exchange or broker, or if authorities obtain control of the relevant private keys. (reuters.com)
Professional intermediaries create another obstacle
The investigation becomes more difficult when funds move beyond directly observable blockchain transactions.
Levin and TRM Labs’ global policy head Ari Redbord told CNBC that professional money-laundering organizations, including networks operating in China, increasingly help hackers convert cryptocurrency into other forms of value.
Their comments concern criminal intermediaries, rather than Chinese trading businesses generally.
Such networks can separate the original attacker from later transactions, introducing additional counterparties and jurisdictions. Once value moves into conventional currency or private financial arrangements, blockchain analysis alone cannot reconstruct every subsequent step.
That increases the importance of cooperation among exchanges, token issuers, financial institutions and law enforcement. Investigators may know where tokens were sent while still lacking access to the records or legal mechanisms needed to recover them.
Compensation and recovery follow separate paths
Binance has pledged to cover losses using its user-protection fund. That commitment addresses who bears the financial consequences; the investigation addresses whether stolen assets can be brought back.
Successful recovery would reduce the financial burden of compensation. An unsuccessful recovery would make the exchange’s available resources and execution of its pledge more consequential.
For market participants, the next meaningful updates will be evidence of assets actually returned, clarification of how frozen tokens will be handled, and a reconciliation of recovered and outstanding amounts.
A final explanation of the security failure will also matter. Recovering funds addresses the immediate damage. Demonstrating that the underlying weakness has been corrected is essential to rebuilding confidence.
