Circle · Tether · North Korea · Cointelegraph
CertiK engineer Dickson Wu traced $500 million in USDT that was sent to one address
Compiled by KHAO Editorial — aggregated from 1 source. See llms.txt for citation guidance.
◌ Single Source
They were racing against some of crypto’s most powerful gatekeepers: stablecoin giants like Tether and Circle, who had already begun blacklisting addresses associated with the theft.
Key facts
- CertiK engineer Dickson Wu traced $500 million in USDT that was sent to one address, with $325 million sold to market makers for ETH by 20:59 UTC, less than an hour after the hack began
- LlamaRisk, an Aave risk service provider, said in its 1:00 am update that the attacker’s position subsequently held around $59.9 million in USDT collateral against $43.8 million in debt
- Elliptic estimated that $2.84 billion had been frozen by 7:00 am UTC on Friday, while the attackers still controlled around $3.33 billion in assets that issuers could not immobilize
- Binance said Friday that about $3 billion of the stolen assets were frozen onchain out of an estimated $6.3 billion total, and that it is working with law enforcement, issuers and blockchain
Summary
Attackers raced to convert stolen stablecoins into crypto that issuers could not freeze as industry players like Tether and Circle moved to immobilize billions of dollars in assets. Attackers behind Binance’s estimated $6.3 billion hack still control billions of dollars in stolen cryptocurrency despite efforts by token issuers to freeze the proceeds. The attack, the largest in crypto history, began at 8:04 pm UTC Thursday and the perpetrators, linked to the same North Korean hackers behind last month’s Bitget hack, immediately began converting assets. The game plan for the hackers was to convert the assets that could be frozen, like USDT and USDC, into ones that could not, such as Bitcoin (BTC) and Ether (ETH). CertiK engineer Dickson Wu traced $500 million in USDT that was sent to one address, with $325 million sold to market makers for ETH by 20:59 UTC, less than an hour after the hack began.