The attackers behind the $6.3 billion theft at Binance have begun splitting their haul along a clear dividing line: assets that can be frozen or potentially clawed back, and assets that sit beyond the reach of freeze controls. That dividing line will go a long way toward deciding how much of the stolen funds can ever be returned.

Stablecoin issuers are pulling blacklist and freeze levers, while the hackers race to move funds into ETH, BTC and other tokens with no issuers or off switches. The scramble to wall off tokens before they cross into unrecoverable territory comes after what has been described as the biggest theft in crypto history — one that, ironically, struck the world's largest crypto exchange. Binance's initial report on the incident blamed the exploit on a compromised DevOps engineer's laptop.

What has been frozen from the Binance hack?

The attackers, whom blockchain intelligence firms TRM Labs and Chainalysis have identified with high confidence as North Korea's TraderTraitor unit, have seen nearly $3 billion of the tokens they moved off the exchange frozen. The attribution carries practical weight: North Korea-linked units of this kind have previously been named in U.S. sanctions actions, which give investigators a legal basis to pursue seizures and forfeitures alongside on-chain freezes.

Tether and Circle, the issuers of the largest stablecoins by market capitalization, have blacklisted roughly 1.77 billion USDT and 825 million USDC respectively, according to TRM Labs. Blacklisting is a built-in control of centralized stablecoins — a listed address's tokens can no longer be moved — a power that simply does not exist for assets like ETH or BTC. Of the 88.5 million RLUSD stolen, Ripple has frozen 40.5 million, while Trump-linked World Liberty Financial has locked 27.8 million of its USD1 token. Arbitrum's Security Council also intervened, helping to stop $30.5 million.

Even so, the North Korea-linked attackers still hold almost $3 billion that no entity can touch, per Arkham and Lookonchain tracking: roughly $1.09 billion in ETH, $1.41 billion in BTC and 682.9 million TRX. The attacker also raised $158.25 million by selling altcoins including AAVE, ENA, LINK, PEPE and UNI, and has since converted all of that money into Ethereum, a non-freezable asset.

Who can intervene and who can't?

DEX aggregator 1inch and the Reserve protocol offer a side-by-side comparison of the intervention bridge the hackers are trying to cross.

1inch said exploit-linked addresses have already been blocked from accessing its dApp, wallet and API. The DEX aggregator also said it has reached out to Binance to offer assistance and is coordinating with ZeroShadow, SEAL 911 and TRM Labs (statement on X).

Reserve, by contrast, could do nothing when the attackers swept up about 3.4 billion of its RSR token. The team wrote on X that "no one, including us, can freeze" the tokens, because RSR is immutable and has no admin keys.

Arbitrum's Security Council took a more hands-on approach. According to the Arbitrum governance forum, the council temporarily modified the network's inbox contract on Ethereum, added a function to reproduce a cross-chain transaction while impersonating the exploit address, and moved 8,425 ETH and 74,559,805 ARB into a holding wallet ending in 0DA0. The council then restored the contract, and the funds can only move after an ArbitrumDAO vote. The council used the same emergency powers in April, when it froze about 30,766 ETH — worth roughly $71 million at the time — tied to the KelpDAO exploit.

What the Bitget hack already showed

Frozen is not the same as recovered, and the industry has fresh proof of how little freezing can catch once an attacker converts. In the September Bitget breach, Cryptopolitan reported that Circle and Tether locked just $318,000 out of $387.5 million stolen, because the thief had already swapped the rest into Ether. Bitquery data cited by Cryptopolitan shows that wallets frozen within a week keep 59% of their USDT after one week, but only 12% after six months.

Binance has suspended deposits and withdrawals, pledged to cover user losses from its SAFU reserve — the exchange's emergency insurance fund, created in 2018 and built up from trading fees — and company funds, and expects withdrawals to resume within 48 hours. Co-CEO Richard Teng sought to reassure users, writing on X: "Your money is safe and we're covering every loss."

The exchange has not said how much of the frozen $3 billion it can actually reclaim, nor has it detailed what will happen to the remaining $3.3 billion. The next markers to watch are all set by the incident itself: whether withdrawals resume on Binance's stated 48-hour timetable, how the ArbitrumDAO vote on the impounded 8,425 ETH and 74,559,805 ARB proceeds, whether more issuers and protocols use their freeze powers on tokens still in motion, and when Binance clarifies recovery prospects for both the frozen and the untouchable portions of the haul.

Source: Cryptopolitan