Uneasy Money: What the $6B Binance Hack Revealed About Who Can Freeze Stolen Funds

Speakers described the Binance incident as involving $6 billion. Taylor Monahan said Zero Shadow’s Harrison spotted an alert showing a large amount moving out of Binance; after seeing it in chat, she raised contacting Tether. One speaker also cited a $1 billion transfer to Tether during the incident. Circle froze funds about three minutes after Tether, according to a speaker. Circle said law enforcement had contacted it, but speakers disagreed about whether authorities could have prompted a freeze that quickly: one doubted it, while another said the FBI contacted Jeremy, though not so quickly. A speaker said Binance had a longstanding law-enforcement relationship and that the FBI was in its office over the weekend.

About $3 billion landed on Ethereum, mostly in Tether and USDC, and the hacker routed most of it through DEX pools, Adam Sadowski said. Roughly 35 minutes into the exploit, apparently after running low on immediately accessible on-chain liquidity, the hacker supplied about $60 million in USDT to Aave and borrowed roughly $45 million worth of ETH. Adam said the hacker was converting freezeable stablecoins into ETH while Tether and Circle moved to freeze funds, describing ETH as not recoverable. The Aave position used the maximum allowed loan-to-value with little buffer and entered liquidation after the market rose. No funds were stolen from Aave: the protocol operated as intended, and suppliers could withdraw.

Aave’s market freeze is a one-way valve, not a lock on user funds: it stops new borrowing and new capital supply, while existing users can repay debt, withdraw capital, and face normal liquidations. Aave guardians used that measure during the incident to reduce risk while letting existing users exit. Stablecoin issuers can block assets through contract-level blocklists; Aave guardians can freeze markets or set loan-to-value ratios to zero. Aave’s risk actions are delegated to risk stewards operated jointly by Llama Risk and Aave Labs, and a four-of-seven multisig guardian group. The manual response required convening a war room, reaching a decision, gathering signers, and preparing a transaction payload.

Adam said Aave is developing a risk-oracle system to limit borrowing over time, but the discussion highlighted a trade-off between controlling exposure and preserving legitimate uses, such as borrowing ETH against stablecoins to short it. Limits can also be circumvented with multiple accounts, while overly restrictive rules can stall activity. Speakers argued that automated, low-latency defenses will matter more as exploit systems using AI agents accelerate, because manual responses may not keep pace. They said effective controls need both verifiable, protocol-controlled logic and rich risk signals, while warning that configurable controls and changes to complex systems can have unintended consequences.

After the incident, Synthetix identified a wallet holding about 9 million stolen SNX. The team had initially assumed it could do nothing and left the tokens untouched, although one speaker estimated that 10–15% of SNX’s total supply was on Binance. Synthetix instead used token authority to approve and transfer the SNX to its DAO, whose proxy system could change any part of the system, including token authority and token state. Speakers said there is no single dollar threshold for intervention: circumstances matter, and Arbitrum had shifted expectations toward action when a protocol can intervene. They considered stopping North Korea from receiving funds stolen from Binance users a justified responsibility, but warned of risks including lawsuits and urged teams to agree on response plans in advance. They contrasted this with an earlier Synthetix incident involving 11 billion synthetic ether, when the team fixed the oracle and let the holder trade through it rather than changing token state; a speaker recalled paying the holder 100 ETH.

During laundering, THORChain double-spent after a one-block Ethereum reorg. The recipient returned the money, but the underlying vulnerability remained, so THORChain shut down most of the protocol and pushed a code update. Speakers estimated the laundering involved about 50,000 addresses and said activity was visible on-chain as early as October 8, while the operation’s timing and preparation remained uncertain. While THORChain was down, the FBI, IRS-CI, and U.S. Secret Service attributed the hack to TraderTraitor, identified by speakers as North Korea. The FBI explicitly asked node operators to block transactions involving stolen assets; operators said they could not intervene. Speakers said THORChain later restarted and processed nearly $200 million in volume involving DPRK-linked funds over two days, including transactions involving addresses on the FBI list. They argued that the formal attribution and operators’ awareness of the notice raised the stakes under U.S. sanctions law, calling the restart a serious concern and the FBI notice a warning shot, while expressing concern about how evidence and communications might be presented in court.