An Overview of the 8 Types of Organizations That Contributed the Most to the "Binance $6.3 Billion Hack Case"

Original | Odaily@OdailyChina)

Author | Wenser (@wenser 2010)

A week later, the impact of the "Binance $6.3 billion asset theft case" has gradually been minimized through collaborative efforts across the crypto industry. Tragedies like the former "Mt. Gox hack" and "FTX collapse" did not recur. The reasons are twofold: the crypto industry has made considerable progress compared to the past and is more antifragile, and various organizations and institutions contributed significantly in this incident by assisting Binance in tracking the hacker attack, freezing stolen assets, supporting security offense and defense, and preventing further fund losses. In this "largest security incident by stolen amount in crypto history," stablecoin issuers, law enforcement agencies, on-chain analytics firms, L2 networks, and DeFi protocols all stepped up to prevent further expansion of losses in their own ways. To some extent, these organizations deserve to be remembered by the crypto industry.

In light of this, Odaily has compiled a "List of Organizations That Contributed Most in the Binance Theft Case" based on public information, for reference by top CEXs and crypto industry participants.

No. 1: Stablecoin Issuer Tether, Assisted in Freezing Over $1.567 Billion

After the Binance asset theft incident, stablecoin giant Tether followed up on freezing the stolen assets at the first opportunity.

Tether CEO Paolo Ardoino posted that it cooperated in freezing over 1.567 billion USDT related to the potential Binance theft. Multiple media outlets reported that about 37 minutes after the stolen USDT arrived at the attacker's main Ethereum wallet, Tether first froze approximately 1.18 billion USDT, and then within 17 minutes froze four more attacker addresses.

As the largest stablecoin issuer, Tether has been particularly proactive in cooperating with handling stolen assets, and was the party that froze the largest amount of funds in this security incident, cutting off a large chunk of the hacker's available balance first and effectively curbing the expansion of losses from stolen funds—a great contribution.

Of course, it should be noted that Tether's freeze only cuts off USDT outflows and does not mean Binance has already recovered the corresponding funds; subsequent processing still depends on the gradual advancement of various procedures.

No. 2: Stablecoin Issuer Circle, Assisted in Freezing Approximately $823 Million

Like Tether, Circle's performance this time was also noteworthy. Circle CEO Jeremy Allaire previously stated publicly that over $800 million USDC related to the Binance theft incident had been frozen, and that it was coordinating with law enforcement. In terms of processing time, Circle was only 3 minutes slower than Tether, which, compared to previous fund-freezing operations, can be considered extremely fast.

Since then, the two stablecoins Tether and Circle have contributed over $2.3 billion of the $3 billion in frozen assets in this case. Stablecoins such as USDT and USDC account for about 94% of the stablecoins among the stolen assets, almost all on the Ethereum and Tron chains.

No. 3: Law Enforcement Agency FBI, Formally Attributed and Published Over 600 Involved Addresses

In this theft incident, it was relatively rare that in addition to the cooperation of crypto industry organizations, U.S. law enforcement agencies also joined the handling camp. Particularly notable was that the FBI also stepped forward.

On October 31, the FBI's cybercrime division issued a notice stating that it had determined the North Korean hacker group was responsible for the theft of over $6 billion in virtual assets from Binance, with the campaign codenamed TraderTraitor.

According to FBI public information, the attacker's involved addresses roughly include over 600 Ethereum addresses, nearly 20 Bitcoin addresses, and 1 Solana address. Subsequently, the FBI, Secret Service, and IRS-CI jointly called on THORChain nodes, RPC nodes, instant exchanges, DeFi services, on-chain analytics firms, and virtual asset service providers to block transactions related to or derived from these addresses.

The Secret Service also subsequently stated that within minutes of the incident it cooperated with industry participants to identify and freeze a considerable portion of the stolen funds, and was jointly investigating with the U.S. Attorney's Offices for the District of Columbia and the Central District of California, as well as relevant divisions of the Department of Justice.

With the FBI's assistance, the handling of Binance's stolen assets essentially entered the视野 of law enforcement agencies globally, providing more safeguards at the law enforcement level.

No. 4: On-Chain Analytics Firms Elliptic, Chainalysis, TRM Labs, SlowMist, Provided On-Chain Intelligence Tracking

Apart from the stablecoin issuers that directly froze assets and the FBI that initiated the investigation, on-chain analytics firms also played a huge role in this security incident, with representative organizations including Elliptic, Chainalysis, TRM Labs, and SlowMist.

Elliptic estimated the theft at approximately $6.43 billion, verified that about $2.85 billion was frozen or seized, and published a downloadable blacklist of involved addresses, which was later expanded to thousands or even tens of thousands of addresses. It also stated that its alerts had prompted some of the stolen funds to be frozen.

Chainalysis wrote in a blog that investigators proactively shared leads with industry partners to assist in identification and freezing; as of approximately 11:30 ET on November 3, about $2.8 billion had been frozen. It earlier disclosed the mixing connection between Binance's stolen funds and the previous month's Bitget stolen funds, reinforcing the North Korea attribution. CEO Jonathan Levin also warned that the hackers had already used thousands of addresses, which could expand to tens of thousands in the coming weeks.

TRM Labs pointed to TraderTraitor with high confidence, comparing the methods to the 2025 Bybit case and the April 2026 KelpDAO case; CNBC also cited its description of Tornado Cash small-amount withdrawals, advance rehearsals, and one-time burst signatures.

SlowMist founder Cos emphasized Binance hackers' attack methods, stating they used the EIP-7702 mechanism to batch-steal hot wallet tokens and had rehearsed for hours before the theft to prepare for the attack; SlowMist Chief Information Security Officer 23pds also previously posted "recommending investigation around private key leakage pathways and abnormal withdrawal tools," which, although slightly different from the actual cause of the incident, still provided many reference ideas for the investigation.

On-chain analytics firms and security organizations are the mainstay in such asset theft incidents; without these professionals, many details would be difficult for the public to know, especially information involving technology and on-chain traces.

No. 5: L2 Networks Arbitrum and Optimism, Protected Approximately $35 Million in Assets Combined

As the attack involved a wide variety of tokens, L2 networks were also among the important participants in responding to the stolen assets.

On the day of the theft on October 30, the Arbitrum Security Council executed an emergency operation to transfer approximately 8,426 ETH and approximately 74.56 million ARB from the attacker's addresses to an intermediate freezing address, totaling approximately $30.5 million. The official emphasized that these funds can only be moved again by the Security Council or Arbitrum DAO governance vote, and other users and applications were unaffected.

Additionally, on the Optimism side, approximately 44 million OP, about $5 million in assets, were moved out of the attacker's addresses by the governance side as protected funds.

Although the amount is far smaller than the frozen assets of Tether and Circle, this is one of the few actions that actually moved assets out of the hacker's control rather than just tagging them. Currently, Binance has applied for the return of these assets through a governance proposal; although the process may take several weeks, it sets a precedent for the recovery of stolen assets.

No. 6: Stablecoin Issuer World Liberty Financial, Assisted in Freezing Approximately $29 Million in Assets

Although the WLFI project has a poor reputation in the crypto market, its cooperative actions in this Binance theft incident were also extremely swift.

Previously, Binance co-founder and Co-CEO Yi He disclosed that World Liberty Financial (WLFI) froze approximately $27 million USD1 related to the incident, as well as approximately $2 million equivalent of WLFI. WLFI co-founder Zach Witkoff publicly confirmed the freezing steps and stated that it would cooperate with BitGo to handle the stolen WLFI and USD1.

It can be seen that quite a few stablecoin issuers lent a hand in this attack incident. In addition to projects such as Tether, Circle, and WLFI, stablecoin issuers such as Ripple for its RLUSD, Paxos, and First Digital also assisted in freezing their respective stablecoins, making certain contributions to protecting the stolen assets.

No. 7: DeFi Protocol Aave, Precautionary Market Freeze Involving $60 Million in Funds

Aave also assisted in its own way in this security incident.

According to on-chain data, the Binance hacker previously deposited approximately 60 million USDT into Ethereum Aave V3 and borrowed approximately 19,762 WETH, worth about $44.6 million at the time. Aave then precautionarily froze hundreds of DAO-operated market reserves across V3 and V4, suspending new deposits and new borrowings, while withdrawals, repayments, and liquidations could still proceed.

Aave founder Stani Kulechov stated that the contracts were unaffected and positions remained overcollateralized.

It is worth mentioning that Aave's biggest role in this incident was not freezing assets, but preventing the hacker from continuing to use stolen funds to add leverage or swap positions in the protocol; the ETH already borrowed remains under the attacker's control.

No. 8: Crypto Exchanges OKX, Coinbase, Bybit, Assisted in Intercepting Fund Transfers

After the Binance theft incident, many CEXs also proactively expressed support and assistance. OKX CEO Star directly called for the establishment of CEX industry security standards and a coordinated response mechanism.

Coinbase CEO Brian Armstrong posted at the first opportunity that his team was doing its utmost to provide support, including intercepting transfers to compromised wallets, and had contacted Binance to offer assistance. He stated that the industry should jointly address the current situation, openly share useful information, and protect customers; the crypto industry has gone through many difficult periods and emerged stronger each time, and this time will be no exception.

Bybit founder and CEO Ben Zhou also publicly stated that reports of security incidents at multiple platforms were circulating on social media. Bybit was unaffected, its systems were operating normally, trading and withdrawal functions remained available, and user assets were safe. Bybit is willing to provide support to Binance in various aspects.

Regarding the recent security incidents involving Bybit, Bitget, and Binance, OKX founder and CEO Star also publicly stated that security should not be an area of commercial competition, but a shared responsibility of the entire crypto industry. Over the past decade, major exchanges have made significant progress in private key protection, but potential risks remain in access control and wallet management systems. He emphasized that no system is absolutely secure, and a major security breach at any exchange could damage trust in the entire industry. He called on major crypto exchanges to strengthen cooperation and jointly establish stricter industry security standards and a coordinated response mechanism, including adding verification and security delays for large withdrawals to unknown addresses and smart contract authorization transactions, and implementing key security restrictions at the cryptographic signature layer. Meanwhile, the industry should establish real-time security incident notification, joint monitoring of suspicious funds, and rapid response mechanisms, and promote collaborative research in areas such as quantum-resistant cryptography and AI security threat defense. He emphasized that no single company can safeguard the future of the crypto industry alone.

The Binance Theft Case Is a Recent Warning; the Crypto Industry Still Needs to Stay Vigilant

Finally, the freezing of stolen funds is only the first half of the Binance theft saga; the real second half of this incident depends on whether the unfrozen related assets can be intercepted a second time through OTC channels, on-chain mixing platforms, and exchange exit points, and ultimately recovered.

With security incidents occurring frequently, maintaining a secure industry environment is the undeniable responsibility of many institutions and organizations. STAY SAFU.