The Binance hack has triggered a series of recovery efforts as crypto platforms move to contain the stolen assets.
Several projects have frozen funds, restricted transactions, or recovered tokens linked to the exploit.
However, the attacker continues moving assets across networks to avoid recovery measures. Synthetix has recovered its stolen SNX, while an error by the hacker stranded millions of dollars in Newton tokens.
Binance hack triggers at least nine recovery attempts
Binance confirmed that attackers stole approximately $6.3 billion in its largest crypto security breach. The amount exceeds four times the $1.5 billion Bybit hack recorded in February 2025. Investigators have linked the attack to North Korea’s TraderTraitor unit. Binance, meanwhile, attributed the breach to a compromised DevOps engineer’s laptop.
Recovery efforts have intensified across multiple blockchain networks. So far, investigators and platforms have frozen or locked nearly $3 billion of the stolen assets. Centralized stablecoin issuers account for the largest recoveries through their token blacklist mechanisms.
Tether blacklisted approximately $1.77 billion in USDT. Circle also froze around $825 million in USDC. Ripple recovered control of 40.5 million RLUSD from the 88.5 million tokens involved. World Liberty Financial also locked 27.8 million USD1.
Meanwhile, Arbitrum’s Security Council used emergency powers to restrict $30.5 million in ETH and ARB. The decentralized exchange aggregator 1inch also blocked the attacker’s addresses across its applications, wallet, and API.
Synthetix recovers $8.4M in SNX as newton tokens become trapped
Synthetix confirmed that its protocolDAO recovered the SNX tokens stolen during the Binance hack. The DAO transferred the recovered assets into its multisignature Safe. The recovered SNX amounts to approximately $8.4 million.
The protocolDAO said it had notified Binance about the recovery. It also confirmed that it would return the tokens upon request.
Newton Foundation reported a separate recovery-related development involving the attacker’s transaction mistakes. The hacker accidentally transferred approximately 8 million NEWT directly to the token’s contract address. The transaction also included 17 other tokens, including ANIME.
NEWT operates as an ERC-20 token on Ethereum with a fixed supply of 1 billion. However, its contract lacks a function that allows anyone to release mistakenly transferred tokens. Consequently, the attacker effectively lost access to approximately $3.5 million in NEWT.
The stranded tokens demonstrate the limitations of immutable smart contracts. Unlike centrally controlled assets, some tokens lack administrative functions that allow issuers to reverse transfers or freeze balances.
Admin keys separate recoverable tokens from unrecoverable assets
Centralized stablecoins and certain protocol tokens include administrative controls. These controls allow issuers or authorized DAOs to freeze balances or restrict transfers. However, native cryptocurrencies such as Bitcoin and Ethereum lack centralized issuers and similar freeze mechanisms.
Reserve encountered this limitation after the attacker acquired approximately 3.4 billion RSR tokens. The team confirmed on X that nobody, including the project itself, could freeze the stolen holdings. RSR has no administrative keys, leaving the tokens beyond the team’s control.
Meanwhile, the attacker has continued converting recoverable assets into cryptocurrencies without freeze functions. The hacker reportedly raised approximately $158.25 million by selling altcoins, including AAVE, LINK, and PEPE. The attacker then converted the proceeds into ETH.
In another transaction, the hacker supplied $60 million in USDT to Aave and borrowed approximately 19,762 ETH against the collateral. The transaction occurred 41 minutes before Aave froze the market. This timing allowed the attacker to withdraw ETH while the USDT collateral remained locked.
Arkham and Lookonchain tracking data indicate that approximately $2.86 billion in stolen assets remain beyond freezing mechanisms. These holdings include $1.09 billion in ETH, $1.41 billion in BTC, and 682.9 million TRX.
Binance has suspended deposits and withdrawals following the exploit. The exchange also pledged to cover affected users’ losses through its SAFU reserve and company funds. Co-CEO Richard Teng reiterated the commitment on X, stating, “Your money is safe and we’re covering every loss.”
