Attackers behind the estimated $6.3 billion hack of Binance still control billions of dollars in stolen cryptocurrency, despite a rapid wave of freezing efforts by token issuers. The episode has become a live test of crypto's onchain intervention tools — showing both how quickly centralized issuers can pull the emergency brake and where that power ends.

The attack, the largest in crypto history, began at 8:04 pm UTC on Thursday, and the perpetrators — linked by investigators to the North Korean hackers behind last month's Bitget hack — immediately set about converting the stolen assets.

Their game plan was to swap assets that could be frozen, such as the stablecoins USDT and USDC, into ones that could not, such as Bitcoin (BTC) and Ether (ETH).

CertiK engineer Dickson Wu traced $500 million in USDT that was sent to a single address, with $325 million sold to market makers for ETH by 20:59 UTC — less than an hour after the hack began. The hackers were racing against some of crypto's most powerful gatekeepers: stablecoin giants like Tether and Circle, which had already begun blacklisting addresses associated with the theft.

Binance said on Friday that about $3 billion of the stolen assets had been frozen onchain out of an estimated $6.3 billion total, and that it is working with law enforcement, token issuers and blockchain analytics firms to trace additional funds.

The scale of the theft is staggering even by crypto standards. But with roughly half of the assets already immobilized, how much of the stolen crypto can the perpetrators actually spend?

Crypto with an off switch

Unlike BTC or ETH, which are decentralized cryptocurrencies with no central issuer and no one able to hit the pause button, centralized stablecoins like Tether's USDT and Circle's USDC have issuers that can freeze tokens held at specific addresses. That gives them the power to act swiftly in incidents like this one.

Tether froze around $1.567 billion in USDT in total, with the first major freeze taking place just 37 minutes after the stolen funds reached the attacker's main Ethereum wallet. Circle froze around $823 million in USDC three minutes later, and other issuers, including Ripple and World Liberty Financial, followed soon after.

The ability to immobilize crypto is not exclusively a stablecoin feature. Although decentralized protocols lack central issuers, some did not sit idly by: Arbitrum's Security Council moved around $30.5 million in ARB and ETH into an intermediary frozen wallet, where the funds can only be moved after further action by the council or a vote by Arbitrum DAO governance. Whether the Security Council or a DAO vote ultimately returns those assets to Binance remains to be seen.

One important distinction remains: frozen funds do not necessarily equate to recovered funds. Immobilizing assets prevents the suspected attackers from spending them, but it does not automatically return the money to Binance or its users.

The Aave complication

The decentralized lending protocol Aave adds another layer of complexity. Between 20:58 and 21:01 UTC, a wallet associated with the attackers deposited $60 million in USDT into Aave V3 on Ethereum and borrowed $44.6 million of wrapped Ether (WETH), roughly 40 minutes before the first freeze.

LlamaRisk, an Aave risk service provider, said in its 1:00 am update that the attacker's position subsequently held around $59.9 million in USDT collateral against $43.8 million in debt. Aave said the position remained overcollateralized and did not put protocol suppliers at risk.

Because the USDT had already been deposited into Aave's lending pool, blacklisting the attacker's wallet could not automatically retrieve the collateral held by the protocol. As Aave Chan Initiative founder Marc Zeller explained: "USDT is real money backed by dollars, and the position is criminal but overcollateralized in the eyes of the protocol."

To prevent further deposits and borrowing, Aave temporarily froze markets across its V3 and V4 deployments, although existing users could still withdraw funds, repay loans and liquidate positions. The protocol later lifted its precautionary freeze across V3 and V4 markets, saying its contracts were unaffected and positions remained overcollateralized. The attacker's own borrowing position remained in place, and what becomes of the criminally sourced collateral it holds has yet to be resolved.

"Just another day in crypto," Zeller said.

So what can the attackers actually keep?

On-chain analytics firm Elliptic estimated that $2.84 billion had been frozen by 7:00 am UTC on Friday, while the attackers still controlled around $3.33 billion in assets that issuers could not immobilize.

And while the freezes almost halved the attackers' profit pool, that does not mean all of the remaining funds are safe to recover. Bitcoin and Ether have no centralized token issuer that can blacklist individual addresses the way Tether or Circle can. Once stolen assets are converted into these native cryptocurrencies, transactions can be restricted, but actually freezing them is far harder.

Binance has pledged to cover all losses using its Secure Asset Fund for Users (SAFU) — the exchange's emergency reserve set aside to protect user funds in extreme situations — and company funds, and says user assets remain safe. According to the latest update from Binance chief executive Richard Teng, the exchange is already "recovering stolen assets for users." With law enforcement, token issuers and blockchain analytics firms still tracing the flows, the fate of the remaining roughly $3.33 billion — and how much of it can still be immobilized or recovered — will help determine the final cost of the largest hack in crypto history.