The Part of the Binance Theft That Cannot Be Frozen

Less than an hour after the first transfers left Binance on October 29, the first brakes were applied. Whale Alert reported freezes of about $971 million in USDT and $823 million in USDC, according to Cyber Kendra's account of the night.

Tether and Circle could do it because they can. A stablecoin is a company's token, and the company keeps a blacklist. Add an address to it and the tokens there stop moving. Nobody keeps such a list for ETH or BTC.

That difference is now the shape of the whole recovery. Elliptic has verified $2.85 billion frozen or seized, about 44% of the $6.43 billion it counts as stolen, and 94% of the frozen amount is stablecoins. It estimates that the attacker still controls roughly $3.21 billion in ETH, BTC, XRP and TRX, none of which an issuer can touch. Binance puts its own loss at about $6.3 billion, and Bitcoin Magazine reports Tether's frozen USDT at about $1.57 billion, Circle's at more than $800 million, and roughly $3.3 billion not frozen. The totals differ because they are counted at different times by different people. The direction does not.

The attacker seems to understand this. Elliptic notes that the stablecoins were converted slowly, which is why so much of them could be frozen. CBS and AFP report that the FBI says the group is converting stolen assets into Ethereum and expects further laundering through decentralized finance and instant swap services. Elliptic describes much of the laundering as automated: 546 TRX transfers from one wallet, a median of 96 seconds apart. It expects the process to take months, as the Bybit funds did.

Meanwhile the exchange has been solving a different problem. By Bitcoin Magazine's count, Binance says it has covered 95% of the impacted amount from its own resources, and it reopened withdrawals on Sunday across 15 networks. Between 06:00 and 15:30 UTC customers withdrew about $4.65 billion against $1.01 billion deposited, a net outflow near $3.64 billion, or about 2.1% of the $171 billion in its late-October proof of reserves.

Those are two separate ledgers. One is what customers are owed, which Binance can settle by buying tokens. The other is what the thief took, which no decision of Binance's can settle. The first decides whether users stay. The second decides how large the final loss is.

It is worth noticing what a freeze does and does not show. It shows that a few companies can stop money they issued. In a market that prides itself on having no switch, this recovery has leaned almost entirely on two of them. That is an observation about this case, not a verdict on stablecoins.

What happens to the remaining $3.2 billion will be decided elsewhere: at exchanges, bridges and swap services, which the FBI has asked to block transactions tied to the group's addresses. Whether they do will show up on-chain long before it shows up in a press release.