Synthetix has clawed back the SNX stolen in Binance's $6.3 billion hack, while the attacker inadvertently stranded roughly 8 million Newton (NEWT) tokens in a contract with no way to release them. The two developments are among at least nine separate moves against the haul from what is now the largest exploit in crypto history — and together they sketch the limits of what can and cannot be recovered on-chain.

At least nine moves against one haul

Binance has confirmed that approximately $6.3 billion was stolen in the incident, an amount more than four times the $1.5 billion Bybit hack of February 2025, which had been the largest until now. Several investigators have linked the attack to North Korea's TraderTraitor unit, while Binance has blamed a compromised DevOps engineer's laptop.

So far, close to $3 billion of the stolen funds has been frozen or locked across chains, with issuers of centralized stablecoins responsible for the largest amounts. Tether blacklisted around $1.77 billion in USDT, and Circle did the same for roughly 825 million USDC.

Ripple froze 40.5 million of the 88.5 million RLUSD that was moved, and World Liberty Financial locked 27.8 million USD1. Arbitrum's Security Council used emergency powers to wall off $30.5 million in ETH and ARB, while DEX aggregator 1inch blocked the exploit addresses from its apps, wallet, and API.

The list shows how a modern exploit response now runs in parallel at several layers of the stack — token issuers acting at the contract level, a DAO security council at the protocol level, and a trading front-end at the application level — rather than through any single kill switch.

Why an admin key decides everything

Issuers of stablecoins — particularly the centralized ones — hold a blacklist function or admin key, a capability also present in the tokens of certain protocols such as Arbitrum. The function allows an issuer or a controlling DAO to freeze or reverse a transfer before it reaches its intended destination.

Native assets such as Ethereum's Ether (ETH) and Bitcoin (BTC) have no issuers and no off switches, meaning they generally move without any company or DAO able to stop them. Other tokens are immutable by design: they cannot be frozen, but they can still be lost if they end up somewhere they can never move from. Whether a token had such a switch was fixed in code at deployment — which is why this recovery effort has split so cleanly along that line.

Reserve ran into exactly that limit. After the attacker swept up about 3.4 billion of its RSR token, the team wrote on X that no one — including the project itself — could freeze the tokens, because RSR has no admin keys. Freezable tokens get stopped; immutable tokens only vanish by accident or design.

Synthetix's claw-back and the hacker's own slip

Synthetix said its protocolDAO recovered the SNX taken from Binance and moved it into the DAO's multisignature Safe. The recovered sum is about $8.4 million. According to the DAO, Binance has been notified and the tokens will be returned on request. The recovery ran through the protocol's own governance rather than an issuer blacklist, ending in a direct hand-back channel with the exchange.

The SNX stolen from Binance has been recovered by the Synthetix protocolDAO. The tokens are secured in the protocolDAO Safe and will be sent back to Binance on request. We have notified Binance. Fuck Kim Jong Un.

— Synthetix ⚔️ (@synthetix) October 30, 2026

The Newton tokens, meanwhile, survived because of the attacker's own error. The Newton Foundation said on X that the thief sent about 8 million NEWT directly to the token's own contract address, along with 17 other tokens, including ANIME.

NEWT is an ERC-20 token on Ethereum with a fixed supply of 1 billion. Because the tokens were sent to a contract address with no function to release them, they became effectively stranded — roughly $3.5 million in NEWT that is now beyond the attacker's control. The episode mirrors the RSR case from the opposite side: the same immutability that blocked any freeze there blocks any rescue here.

The $2.86 billion no one can touch

The attacker has been converting freezable assets into assets that cannot be locked. The bad actors raised about $158.25 million by selling altcoins such as AAVE, LINK, and PEPE, then funneled the proceeds into ETH.

In another reported move, the attacker supplied 60 million USDT to Aave and borrowed about 19,762 ETH against it — a transaction that occurred just 41 minutes before Aave froze the market. That window was enough for the attacker to walk away with ETH while the freezable stablecoins remained behind as collateral.

According to Arkham and Lookonchain tracking, assets worth $2.86 billion of the stolen funds now sit in tokens with no freeze function: $1.09 billion in ETH, $1.41 billion in BTC, and 682.9 million in TRX.

With that much of the haul now beyond issuer reach, the remaining levers narrow to on-chain tracing of the kind Arkham and Lookonchain are performing, and to choke points where stolen crypto meets exchanges and other off-ramps.

Binance has suspended deposits and withdrawals and says it will cover user losses from its SAFU reserve and company funds. Co-CEO Richard Teng wrote on X: "Your money is safe and we're covering every loss."