The Biggest Crypto Heist Ever, and the Three Minutes That Beat the Freeze

It is the biggest crypto heist ever, and the headline everyone is celebrating is the freeze: Tether froze $1.57 billion in stolen USDT, Circle froze over $800 million in USDC, and about half of the $6.3 billion that left Binance is now locked on-chain.

But inside the same night there is a three-minute transaction that shows exactly where freeze power ends. This is the whole story, as verified as it can be while it is still unfolding.

The first alarm

On October 29 at 20:24 UTC, a Binance hot wallet on Ethereum sent about 63 tokens and 167,464 ETH to a single address in one transaction. Minutes later, a second Binance hot wallet sent 28,006 ETH to the same destination, while 18,270 BTC and 613 million USDT on Tron moved to new addresses around the same time. This timeline comes from Aave's risk team, who tracked the wallet cluster live, and research firm Kairos Research, cited by CryptoSlate.

Kairos estimates about $5.7 billion left the exchange in total. The attacker used Ethereum's EIP-7702 delegation mechanism to attach executable code to a Binance hot wallet, and a single transaction three minutes later swept the 63 tokens. A second inflow of 444,537 AVAX at 23:04 UTC suggests the compromise was still active more than two hours after it started.

Binance's first public word was that it was investigating a "potential security issue." Its official announcement later put the estimated impact at $6.3 billion, making this the largest crypto hack in history, ahead of the $1.5 billion Bybit hack in 2025.

The exits: turning freezable money into unfreezable money

The attacker did not just sit on the funds. According to Etherscan records reviewed by Decrypt and Aave's risk team, the cluster spread across more than 20 new wallets and started converting, fast:

• On Uniswap, wallets received tens of thousands of ETH in exchange for stablecoins: 20,940 ETH at 20:34 UTC, 3,552 ETH at 20:47, and further batches of roughly 18,085 and 16,498 ETH.
• On Aave, between 20:58 and 21:01 UTC, one wallet supplied 60 million USDT as collateral and borrowed 19,762 ETH against it, worth about $44.6 million. Three minutes, start to finish.
• The cluster also sold governance tokens like UNI, LINK and AAVE for ETH on decentralized exchanges.

The logic is brutal in its simplicity. USDT and USDC are tokens run by companies. Tether and Circle can blacklist an address, and whatever sits in it stops moving. ETH is Ethereum's native asset: no token contract governs it, so there is no issuer that can freeze it on-chain. Every dollar converted before a freeze landed was out of reach.

The Aave borrow deserves one honest mechanical note. The 60 million USDT he supplied now sits in Aave's shared pool, not in his wallet, and what he holds is a claim on that pool. Aave has no blacklist function, so Tether freezing his address does not automatically freeze that claim. As of Aave's latest update, he has not touched the position since 21:01 UTC, and what happens to the collateral is now a question of liquidation rules and whatever investigators do next. What is already settled: the borrowed ETH is out, no freeze power reaches it, and he has no reason to repay the loan, because repaying would only hand him back a claim on tainted USDT.

The freeze

The response was the fastest and largest the industry has ever mounted:

• Tether froze nearly $1.57 billion in USDT
• Circle froze over $800 million in USDC (about $823 million)
• Ripple froze roughly $200 million in RLUSD, per Binance co-founder Yi He
• World Liberty Financial restricted $27 million in USD1, and Paxos froze about $8 million in PAX Gold

(Figures per Reuters and company statements.) Binance says about $3 billion is frozen on-chain so far, roughly half of what left.

Aave, whose contracts were never compromised, froze 175 markets across 16 networks on V3 and 117 on V4 between 21:42 and 23:04 UTC to close the conversion route before it could be used again. Existing positions still repay, withdraw and liquidate normally, and the attacker's position remains overcollateralized. As contributor Marc Zeller put it, the protocol will be fine.

Who did it, and how they got in

Binance says its initial investigation points to a compromised DevOps engineer's laptop, which let the attacker access a service container and submit unauthorized withdrawal transactions. It found no evidence of a private key leak. Treat this as preliminary: the full technical post-mortem has not been published yet.

Two analytics firms, TRM Labs and Chainalysis, have attributed the attack with high confidence to a North Korean hacking unit called TraderTraitor, the same cluster of actors linked to the Bybit hack, per the BBC. TRM's Ari Redbord called it a "watershed moment" and warned that the attacker still holds an enormous sum, so recovery is far from over.

What Binance did

Binance temporarily suspended deposits and withdrawals, revoked the compromised address's authorization, and brought in law enforcement and blockchain intelligence firms. It says it will cover all losses from its SAFU fund and company funds, that user funds are safe, and that it will publish an updated Proof of Reserves once remediation is complete. Withdrawals were expected to resume within about 48 hours.

Markets flinched: bitcoin fell more than 4% below $78,000, and the governance tokens the attacker was dumping fell harder (AAVE and LINK down about 9%, UNI about 8%, per Aave's risk team at 00:55 UTC). Stablecoins held their pegs.

The honest scoreboard

It would be easy to read this night as "freezes are useless." The numbers say otherwise: about half of $6.3 billion was frozen within hours, an unprecedented coordinated response across multiple issuers and chains. The Aave conversion was $44.6 million of the total.

But the freeze has a speed limit, and it is measured in minutes. The attacker needed three. DeFi runs 24/7, has no compliance button, and will lend anyone ETH against stablecoin collateral at 3am on a holiday. In a crisis, every permissionless lending pool and DEX is a potential conversion endpoint from freezable money to unfreezable money.

If you build anything that takes stablecoins as collateral, deposits or payment, you just watched your threat model play out in production. Your protocol is not a bystander in the next incident. It is infrastructure.

The freeze saved billions. Three minutes on Aave showed where it ends. Both are true, and building like only the first one is true is the mistake this heist leaves behind.

What we still do not know

How the engineer's laptop was compromised. How much of the remaining billions is recoverable. Whether the attacker can extract the Aave collateral. And the full post-mortem, which Binance says comes after the investigation. If you are reading this weeks later, check those updates before quoting any number here.