Binance Hackers Net $182 Million in Bitcoin, Ethereum; Stablecoins Frozen

Binance Hacker Holds $3.1 Billion in Liquid Assets, Primarily Bitcoin and Ether

Following a massive security breach, the hacker responsible for compromising Binance’s hot wallet is estimated to hold approximately $3.1 billion in assets that can be freely moved. The largest portions of these funds are $1.4 billion in Bitcoin (BTC) and $1.08 billion in Ether (ETH).

Breakdown of Hacker’s Holdings

The remaining liquid assets include approximately $282 million in XRP, $226 million in Tron (TRX), $91 million in Solana (SOL), and about $50 million spread across 33 smaller altcoins that have not yet been sold.

On the Ethereum network, most stablecoins and altcoins stolen have been converted into ETH. The hacker initially took around 197,000 ETH, a figure that has since increased to approximately 492,000 ETH. Notably, no Bitcoin, XRP, or SOL have been moved. USDT on the Tron network has been exchanged for TRX.

Direct Theft of Ether

Approximately 197,000 ETH were directly stolen. An initial transfer of 197,460 ETH occurred at 04:38 UTC to a treasury address (0x8532…), with an additional 2,000 ETH added at 09:14 UTC. No further movement of these funds has been observed.

Stablecoin Swaps

Around 180,000 ETH were acquired through stablecoin swaps. Before Tether’s blacklist took effect at 05:01 UTC, the hacker transferred 500 million USDT to an address. Of this, 325 million USDT were exchanged for 122,310 ETH via market makers. Another portion was distributed to various addresses and sold on decentralized exchanges, ultimately accumulating 57,892 ETH, including 19,763 ETH borrowed from Aave.

Altcoin Sales

Approximately 114,000 ETH were obtained by selling altcoins. As of 09:01 UTC, Lookonchain reported that seven altcoins, including UNI, ENA, and PEPE, were exchanged for 70,480 ETH.

Bitcoin Movement

At 04:20 UTC, Binance’s Bitcoin hot wallet transferred 18,270.2 BTC in 10 separate transactions to a new address. Within the same block, these funds were further distributed across 19 addresses, with 17 of them holding exactly 1,000 BTC each. The total amount remains 18,270.2 BTC, with no sales or transfers to exchanges detected.

XRP Status

Between 04:05 and 04:09 UTC, five Binance XRP wallets were emptied, with approximately 233 million XRP transferred to a single new account. No further outgoing transactions have been recorded. XRP is the native currency of the XRP Ledger, and its issuance is not controlled by a single entity that can freeze assets.

Solana Transfer

At 04:11 UTC, 965,455 SOL were transferred to a new address. The current balance in this address is 970,545 SOL, with no further transfers made.

It is important to note that the attribution of these Bitcoin, XRP, and SOL movements to the hacker is based on on-chain analysis and has not yet been officially confirmed by Binance.

Frozen Assets

Binance has been actively working with various entities to freeze stolen assets. The primary frozen assets include:

• USDT: Approximately $1.38 billion across three hacker addresses on the Ethereum network, plus $313 million on Tron.
• USDC: $823 million, with Circle freezing the receiving address at 05:05 UTC.
• Other Assets: 29,934 wBETH (approximately $73 million), 12,574 XAUt (approximately $50 million), approximately $40.54 million in RLUSD, as well as USD1, WLFI, PAXG, and FDUSD. Additionally, 8,426 ETH and 74.56 million ARB (approximately $30.5 million) on Arbitrum were moved by a security committee.

On-chain analysis indicates frozen assets totaling around $2.7 billion, with an additional $2.75 billion from the Arbitrum transfer. Binance has officially stated that the verified frozen amount is approximately $3 billion. Blockchain investigator ZachXBT reported over $2.83 billion frozen as of 09:01 UTC, though Binance has not released a detailed breakdown.

Tron USDT Freeze

Half of the USDT on the Tron network has been frozen. At 04:22 UTC, Binance’s Tron hot wallet transferred 612,729,468 USDT to a new address. After the hacker withdrew 300 million USDT, Tether froze the address at 05:09 UTC, effectively blocking the remaining 312,729,468 USDT. Whale Alert also reported this freeze. The 300 million USDT that were transferred out were converted into approximately 638 million TRX, which are currently held in another new address without further movement.

Binance experienced its largest-ever hacker attack, leading to a temporary suspension of deposits and withdrawals. Executives He Yi and CZ have pledged full compensation for all affected users. Approximately $2.54 billion in assets have been frozen. Aave has temporarily frozen its V3 and V4 markets, though deposits and withdrawals remain operational. Updates indicate that the total frozen amount has risen to approximately $3 billion, with the resumption of deposit and withdrawal services pending further notification.