Stolen stablecoins: how the market absorbed $3.45B from Binance

On October 29, an attacker took about $6.3B from Binance, by the exchange’s own count. Of that, $3.45B was stolen stablecoins, and unlike the rest of the funds, their issuers could freeze them. The FBI has since attributed the attack to North Korea.

This piece follows those dollars: how the attacker raced to turn them into ETH before the freezes landed, what that cost, who collected it, what it did to prices, and whether Binance’s customers ran once withdrawals reopened. For what was taken and what compliance teams should do now, see our main analysis, Binance hack: what we know & what teams should do now.

Key takeaways

• How it got out: the attacker turned $553M of stablecoins into ETH on Ethereum through market makers on UniswapX and 1inch, Uniswap pools, an Aave loan, and DEX sales, and moved $234M more through Tron. Issuers froze $2.65B (77%) of the $3.45B taken; about $800M got away.

• What it paid: about $91M, or 16% of the $553M, most of it on the fastest USDT routes: 26% on Aave, 22% sweeping pools, and 16% through market makers.

• Who got paid: market makers earned a gross spread of about $45M, and liquidity providers and arbitrage bots about $31M. The last $15M went to no one: it is surplus collateral locked in Aave.

• What it did to prices: for about an hour, ETH traded up to 25% higher in Uniswap’s USDT pools than on Coinbase, and USDT fell to $0.95 on Curve while holding $0.998 on exchanges.

• How customers responded: they withdrew $7.3B in the two days after Binance reopened, about a third more than in the same two days a week earlier. Deposits stalled at the same time, which fits customers catching up after two days without access. Stablecoin supply kept its pre-hack trend.

$3.45B that could be frozen

Most stablecoin issuers can blacklist an address, which stops it moving their tokens. That gave the attacker’s stolen stablecoins a problem its stolen ETH and BTC did not have: once a wallet was flagged, the dollars in it were stuck. The attacker had to swap them for something that could not be frozen, and fast.

At 20:24 UTC on Thursday, October 29, two of Binance’s Ethereum hot wallets sent their contents to one address, 24 seconds apart. That included $1.67B of USDT, $88.5M of RLUSD, $27.8M of USD1, $9.7M of USDe, and about 200 other tokens. Another $823M of USDC followed from a third Binance wallet at 20:41 and 20:59. On Tron, $612.7M of USDT left Binance at 20:22.

Download as CSV

Above: Stablecoins taken from Binance on October 29, and how much each issuer froze

How did the attacker get the stablecoins out?

Within 10 minutes, the attacker split $700M of USDT between two fresh wallets and ran three routes at once. What it could not sell, it passed down a chain of new wallets, most of them emptied before Tether caught up.

Market makers. From 20:36 to 20:50, the attacker sold $275M of USDT to four professional market makers and solvers through UniswapX and 1inch, for 101,376 ETH. All four quote large trades for a living and were trading before the hack. One took $145M on its own. A first order of $50M at 20:34 went differently: the contract that filled it routed it straight into DEX pools through LI.FI.

Pool sweeps. From 20:47 to 21:09, a relay of fresh wallets pushed $110M of USDT into DEX pools, mostly Uniswap’s ETH pools, in short bursts: about $10M from the first wallet, then $50M each from two more.

An Aave loan. At 20:57, one wallet posted $60M of USDT to Aave as collateral and borrowed 19,762 ETH against it three minutes later. The loan, still open, worked as a one-step swap that left the freezable asset behind.

RLUSD on DEXs. From 21:42, the attacker sold $48.0M of RLUSD over 18 minutes through Curve and Uniswap pools and a DEX aggregator, until Ripple froze the selling wallet at 22:00:59 with $40.5M left.

USDe in one pool. USDe cannot be frozen, so it could wait. At 22:56, the attacker moved $9.7M to a new wallet and sold it for USDC over three hours, $8.6M of it through one thin Uniswap pool, then swapped the USDC into ETH.

SUN.io on Tron. The $612.7M of USDT on Tron sat for 23 minutes before $300M moved on in two steps. About $234M went into the SUN.io exchange, including $33M paid straight into its SunSwap pool contract, and $66.0M was frozen downstream.

What the routes left behind was frozen. At 21:01:35, Tether blacklisted the main wallet and the first hop wallet, and a second hop 12 seconds later, about 24 minutes before its CEO announced the freeze. Those hops were empty, but the main wallet held $971M of USDT, and two later hop wallets were caught with $205M inside. Circle’s blacklist landed at 21:04:59, six minutes after the last USDC arrived, so all $823M stayed frozen. World Liberty, Ripple, and, on Tron, Tether froze the rest.

Binance’s compromised wallet kept sending USDT after Tether’s freeze: $204M at 21:04 and 21:44. A USDT blacklist stops a frozen address sending, not receiving, so that money froze on arrival.

In all, about $800M of the $3.45B got away: the $553M converted on Ethereum, $234M on Tron, and about $12M on Avalanche and in FDUSD that we did not trace.

What did the swaps cost the attacker?

Download the table as CSV

The USDT routes got more expensive as the selling went on. The first $50M, which reached the pools at 20:34 before anyone else sold, cost 4.9%. The market makers then charged an effective $2,713 of USDT per ETH while ETH traded at about $2,272 on Coinbase. Their price climbed with every fill: the first $100M went at 10% above Coinbase and the last $50M at 32%. After that, the attacker passed its remaining $175M down the chain instead.

Market makers still beat the pool sweeps and Aave, because they can quote large blocks and settle them in a few transactions. A pool offers only what sits in it, and each burst swept that at once. Of the USDT routes, Aave cost the most, because the $60M of USDT stays behind as collateral. In exchange, the trade could not be frozen afterwards.

RLUSD, sold later into calmer markets, cost about 0.5% to sell and another 2% to turn into ETH. USDe was the exception. The one coin that cannot be frozen was the most expensive of all, because the attacker sold almost all of it into one thin pool.

Who collected the $91M, and why did the checks come too late?

Download the table as CSV

Very little of this was fees. Explicit fees came to about $1.4M: roughly $0.7M to the pools, $0.3M in aggregator and routing fees, and $0.4M that the market makers paid block builders. The rest was price.

Market makers took the largest share, a $45M gross spread for holding a token that could be frozen at any minute. The largest buyer passed the risk on by selling USDT into the same Uniswap and Curve pools at depressed prices, so part of that spread went on to them.

Liquidity providers in Uniswap’s ETH pools were paid first on the pool routes: every burst of stolen USDT bought ETH from them at up to a quarter above the market. Arbitrage bots then took part of that back. Each one that sold ETH into the inflated pools, or bought USDT at 95 cents on Curve, earned a slice of the gap.

None of these firms was part of the attack. They traded against anonymous order flow at prices that paid for the risk. The problem was speed:

Trades settled before any warning. The market makers’ fills were done by 20:50, before the first freeze and before Binance or any issuer had said anything in public.

Lending and pools had no time to react. Aave accepted the $60M of USDT at 21:00 and closed the route 47 minutes later. A permissionless pool cannot pause to ask where funds came from, so any check has to happen before an order reaches it.

Freezes took 37 minutes. By the time the first blacklist landed, the fastest routes were mostly done.

What did the stolenUSDTdo to prices?

For about an hour, the stolen USDT split Ethereum’s on-chain markets from the rest of crypto.

On Coinbase, ETH traded between about $2,230 and $2,300 through that hour, and USDT held $0.998. In Uniswap’s largest USDT pools, ETH rose to $2,824 in the 10 minutes from 21:00, a 25% premium to Coinbase’s $2,255. The USDC pool ran up to 19% above Coinbase. In Curve’s main stablecoin pool, USDT fell to a 10-minute median of $0.949 by 21:10, with single fills as low as $0.84.

Above: ETH and USDT on-chain against Coinbase, October 29, with the attacker’s routes and the freezes

The gap opened at about 20:35, twelve minutes before the attacker’s relay sweeps. The first $50M order hit the pools at 20:34, and the market makers then unloaded USDT as they filled the rest. The largest one’s trading wallet started selling at 20:31 and put $46.5M into the pools in a single transaction at 20:45:11.

The gap closed only once the selling stopped. On-chain ETH was back within 2% of Coinbase by 21:40, and USDT on Curve was back above $0.99 by 21:20. Arbitrageurs normally close a gap like this in seconds. Three things kept this one open for an hour:

Not enough on-chain ETH. The selling, the attacker’s $110M plus what the market makers passed on, outran the ETH arbitrageurs usually keep on-chain.

No quick refill. Refilling that inventory means moving funds off exchanges, and the largest exchange had just had its hot wallets emptied.

Wary buyers. The USDT on offer had just been stolen, so some buyers likely waited to see how Tether would respond.

The other coins barely moved. RLUSD dipped to $0.981 during the sale and recovered by 22:00, and USDe stayed within half a cent of $1 outside the pool the attacker sold into.

Was there a run on Binance?

Did customers leave? Binance paused withdrawals on the evening of the hack, suspended deposits at 00:07 UTC on October 30, and reopened withdrawals at 06:00 UTC on November 1. Net stablecoin outflow was $3.51B that day and $2.68B on November 2. Binance’s own figure for November 1, across all assets, was a net outflow of about $3.6B by that afternoon, or 2.1% of the $171B it holds. By the morning of November 3, the direction had reversed, with $1.59B of net inflow.

Above: Net stablecoin flow in and out of Binance, by day, October 25 to November 3

That is less of a run than it sounds. Customers withdrew $7.3B on November 1 and 2, a Sunday and Monday. That is about a third more than the $5.5B of the previous Sunday and Monday, after two days when they could not withdraw at all. The bigger change was deposits: only $1.2B came in over those two days, against $4.5B a week earlier. Deposits were open, so customers appear to have held back; by the morning of November 3, $2.9B had come in.

Where did it go? We traced $7.7B of customer stablecoin withdrawals from November 1 to 3: $5.52B of USDT, $2.02B of USDC, and $200M of other coins. Of that, $2.66B reached other exchanges, spread across at least 10 venues. Bybit took the most, $763M, followed by OKX ($631M) and Coinbase ($296M, including its Prime business). About $930M went to other identified businesses, from lending protocols to trading firms, and $354M to Circle’s own wallet. The remaining $3.79B is still at the first address it reached, has moved on to wallets with no public identity, or was spread in amounts under $250,000. That pattern is consistent with money moving into self-custody.

Above: Where stablecoins withdrawn from Binance went, November 1 to 3

No rival exchange gained anything close to what Binance lost. Binance’s labeled stablecoin holdings fell from $51.0B to $39.7B over the week to November 2, down 22% including the theft. The largest gain elsewhere was Bitfinex’s $350M, then Coinbase’s $277M. OKX and Bybit received the most withdrawals, yet their balances fell by $261M and $119M, which suggests much of that money moved on again.

Did people redeem? Only at the margin. The $354M of USDC that reached Circle is consistent with large holders redeeming. Had the hack shaken trust in stablecoins, supply would have fallen faster. It did not.

Download the table as CSV

USDT was already shrinking by about $430M a day before October 29 and kept the same pace afterwards. USDC was flat. PYUSD and USDG shrank faster, by $312M and $255M, but Binance held almost none of either, and we found no link to the hack. The issuers have not yet burned the frozen tokens, so $2.65B still counts in supply.

Methods: analysis of public on-chain data from October 25 to early November 3, 2026, across Ethereum, Tron, and the other EVM chains Crystal covers. Costs are measured against the market price at the time of each trade; the market-maker and Aave routes are valued at Coinbase’s ETH price. Customer withdrawals exclude $852M that Binance moved between its own wallets on Ethereum and Tron (gross outflow from November 1 to 3 was $8.59B). The two-day comparison with the previous week includes Solana; withdrawals on Solana ($902M gross from November 1 to 3) are not traced to their destinations. Exchange balances combine customer and exchange-owned funds. This is not investment advice.

Frequently asked questions

Can stablecoin issuers freeze stolen funds?

Most can. Tether, Circle, Ripple, and World Liberty can blacklist an address, which stops it moving their tokens. Ethena’s USDe cannot be frozen, so the attacker could wait before selling it. A USDT blacklist stops an address from sending, but the address can still receive, so USDT that kept arriving after Tether’s freeze was frozen on arrival.

How much of the stolen Binance stablecoins was frozen?

Issuers froze $2.65B, or 77%, of the $3.45B taken. Circle froze all $823M of USDC and World Liberty all $27.8M of USD1. Tether froze $1.76B of the $2.50B of USDT, and Ripple $40.5M of the $88.5M of RLUSD. About $800M got away, most of it swapped into ETH on Ethereum or moved through Tron.

Who profited from the stolen stablecoins?

The attacker gave up about $91M to turn $553M of stablecoins into ETH. Market makers earned a gross spread of about $45M, and liquidity providers and arbitrage bots about $31M. The last $15M sits as surplus USDT collateral in the open Aave loan. None of these firms was part of the attack: they traded against anonymous order flow, faster than any issuer could act.

Was there a run on Binance after the hack?

Less of one than the outflows suggest. Customers withdrew $7.3B on November 1 and 2, about a third more than in the same two days a week earlier, after two days without withdrawals. Deposits fell further, to $1.2B from $4.5B. Stablecoin supply kept its pre-hack trend, and no rival exchange gained more than $350M.

What this means for your team

Check large orders before they settle. The signal was there from the first order: a wallet funded minutes earlier from an exchange’s drained hot wallets, paying well above the market. Market makers, liquidity providers, and arbitrage bots collected most of the attacker’s $91M within minutes, faster than any issuer could act. Only a check before the trade keeps pace with that.

Don’t wait for the issuer. Freezes caught the stablecoins that sat still, including all of the USDC and USD1. What moved in the first 35 minutes escaped. Funds also kept arriving at frozen addresses, so a team handling an incident should stop its own outbound flows too.

Follow the money before calling a run. Binance’s balance fell $11.3B in a week, yet withdrawals ran only a third above normal, stablecoin supply kept its trend, and no rival exchange gained more than $350M. Most of the drop was the theft itself, plus customers catching up after two days without withdrawals.