Binance Hackers Flee Into DeFi as Tether and Circle Freeze Billions
Set Trending Topics as a preferred source on Google.
Crypto is decentralized only until someone hits the emergency switch. The record hack at Binance has set off a race that shows how the crypto world really works. On one side, the attackers, believed to be North Korean, are trying to move their loot to safety through decentralized finance platforms (DeFi). On the other, stablecoin issuers, lending protocols and even an entire blockchain are freezing billions.
Why Stablecoins Can Be Frozen
A large share of the roughly $6.3 billion drained from Binance consisted of stablecoins such as Tether’s USDT and Circle’s USDC. These dollar-pegged tokens run on public blockchains such as Ethereum or Tron, but they are issued by a single company. And that company has built a back door into the tokens’ smart contracts: It can put individual addresses on a blacklist. The coins held at those addresses can then be neither moved nor sold.
That is exactly what happened on a large scale overnight into Friday. According to an analysis by TRM Labs, about $2.7 billion had been frozen by early Friday morning:
- Tether: about 1.77 billion USDT
- Circle: about 825 million USDC
- Ripple: about 40.5 million RLUSD
- World Liberty Financial: about 27.8 million USD1, the stablecoin linked to the Trump family
- Arbitrum Security Council: 8,426 ether and 74.6 million ARB tokens worth about $30 million
According to TRM, the first freezes took effect about an hour after the first outflows. Tether’s chief executive, Paolo Ardoino, and Circle’s chief executive, Jeremy Allaire, announced their freezes publicly themselves.
The Race: Out of Stablecoins, Into Ether
The attackers know, of course, that their stablecoins can be frozen at any time. Their goal was therefore to swap USDT and USDC as quickly as possible into cryptocurrencies that have no central issuer, primarily ether and bitcoin. Nobody can block those.
To do so, they used decentralized exchanges that operate without intermediaries and without identity checks. According to TRM, they sold about 325 million USDT through UniswapX and similar services for about 122,300 ether, at a discount of more than 10 percent. Speed apparently mattered more than price. They swapped another 200 million USDT from the Tron blockchain on Uniswap via intermediary wallets. With Ripple’s RLUSD stablecoin, they managed to sell about $48 million before Ripple froze the rest.
How Aave Became a Laundromat
The detour through lending protocols was particularly clever. On Aave, the largest decentralized lending platform, the attackers deposited about 60 million USDT as collateral and borrowed nearly 19,800 ether worth about $44 million in return. The trick: The USDT then sits in Aave’s pool rather than at an address controlled by the attackers that Tether could block. The borrowed ether, on the other hand, belongs to the attackers and cannot be frozen. They do not care that they will never repay the loan. On the Tron blockchain, they followed a similar pattern with 300 million USDT on the JustLend platform.
Aave responded about 40 minutes after the loan and froze its markets. According to Cointelegraph, the freeze covered 175 markets in version 3 across 16 blockchains and 117 markets in version 4 across four blockchains. Users can still withdraw funds and repay loans, but new deposits and borrowing are blocked. The risk analysts at LlamaRisk warn that a prolonged freeze could push up borrowing rates. The Solana platform Kamino also paused borrowing in one of its markets as a precaution, even though it said it was not affected.
When a Blockchain Steps In
The layer-2 network Arbitrum went the furthest. Its Security Council, a body of 12 elected members with emergency powers, simply moved the attackers’ ether and ARB tokens to an address nobody controls. The funds are no longer accessible to the address that originally held them, and the move did not affect any other users or applications, Arbitrum said. Only the Security Council itself or a vote of the Arbitrum community can release them.
It is not the first time. In April, after the hack of the platform KelpDAO, which investigators also attributed to North Korea, the Security Council froze more than 30,000 ether worth about $71 million.
How Decentralized Is DeFi Anymore?
For some, this is a success: The quick interventions are what have kept about $3 billion of the loot blocked. Steven Goldfeder, a co-founder of Offchain Labs, the company behind Arbitrum, argued after the KelpDAO freeze, according to CoinDesk, that putting the decision to a vote of all token holders would have meant consulting the attackers, too. In his view, the intervention made Arbitrum neither more nor less decentralized.
Critics, however, see a dangerous precedent. If a small group intervenes once, where is the line, and who decides? The same applies to Tether and Circle: The power to block hackers’ wallets is the same power they could use to block any other address, for example at the request of a government agency. And the DeFi protocols themselves showed overnight that, in an emergency, they have a kill switch that a small circle can operate.
None of this can truly stop the attackers anyway. According to TRM, about $2.4 billion remains beyond the issuers’ reach, including more than 420,000 ether and 18,270 bitcoin. The bitcoin has already been split across numerous wallets, and TRM expects the attackers to turn next to cross-chain bridges, swap services and over-the-counter brokers.
