When a leading cryptocurrency exchange suffers a security breach, hackers typically start laundering stolen digital assets by rapidly converting them to Ether (ETH). Experts note that this move is not a signal of faith in ETH itself, but rather a strategic choice based on practicality, allowing greater control and speed while reducing the risk of exposure or asset freezes. This method was observed following significant incidents such as the Binance and Mercado Bitcoin attacks, where cybercriminals immediately moved large amounts of stolen tokens into ETH.
Stablecoin limitations and the lure of ETH
The fundamental distinction between ETH and major stablecoins like USDT (Tether) and USDC (Circle) lies in centralized control. Both Tether and Circle possess administrative authority to freeze wallets holding their respective tokens. If an address is blacklisted, issuers can halt transfers, preventing further movement of stolen funds unless they directly intervene. In contrast, ETH is issued natively on the blockchain without any administrative controls or intervention mechanisms, giving attackers a pathway that circumvents asset freezes.
Once ETH enters the attacker’s wallet, there is no central entity capable of blocking or freezing its transfer. The only major point of potential disruption occurs if funds are sent to a regulated exchange, where compliance measures can prompt a ban or account freeze. This limitation played a significant role during the Binance security event.
In the aftermath of these attacks, both Tether and Circle issued statements collected by blockchain analytics firm Bitquery confirming they immediately froze $1.567 billion in USDT and $823 million in USDC following suspicious transfers, totaling nearly $3 billion in locked stablecoins. Despite these efforts, 470,900 ETH remained under hacker control, unaffected by any blacklist. Mercado Bitcoin, another affected exchange, managed to freeze over $11 million in stablecoins; however, the attacker succeeded in swapping $10.5 million of various cryptocurrencies into 4,605 ETH across 338 transactions, according to Arkham Intelligence.
Mini dictionary: Arkham Intelligence is a blockchain analysis platform that provides real-time data and tracing solutions for monitoring cryptocurrency flows and tracking on-chain activity.
Statements from Tether indicated $1.567 billion in USDT were frozen, while Circle reported halting $823 million in USDC. Despite intervention, attackers controlled 470,900 ETH that could not be blacklisted.
Technical edge and laundering strategies
Many of the largest exploits occur on Ethereum or EVM-compatible networks, where ETH serves as the primary gas asset. Operating directly on these chains streamlines the laundering process: crypto can be moved rapidly without relying on cross-chain bridges or facing time delays. Quick movement matters, as investigators deploy countermeasures within minutes of a breach.
ETH’s deep liquidity is another draw, allowing exploiters to execute large transactions with minimal slippage compared to smaller altcoins. ETH also functions as a gateway asset, enabling further splits, bridging, or swaps into other networks or coins. For instance, in the Binance hack, investigators traced flows from SOL to USDC to ETH, then ultimately to Bitcoin via the cross-chain protocol THORChain, which does not require an exchange account.
Mini dictionary: THORChain is a decentralized cross-chain liquidity protocol that enables users to swap assets across different blockchains without an intermediary.
Regulatory spotlight and future developments
For exchanges, organizing quick freezes on certain tokens can help recover or safeguard some stolen funds, but this approach cannot affect amounts already converted into ETH or Bitcoin. The effectiveness of intervention now relies heavily on advanced wallet screening and enhanced intelligence sharing among stakeholders. For regulators, the contrast in recoverability and control between stablecoins and native assets like ETH is increasingly significant.
Centralized stablecoins offer compliance options that decentralized networks do not, a gap that shapes ongoing regulatory debate. Proposed legislation such as the GENIUS Act seeks to formalize freeze requirements for authorized stablecoin issuers. For developers, core features like decentralization and censorship resistance give ETH its unique value, even as they complicate anti-laundering efforts.
On the investor side, the repercussions are typically indirect, related mainly to market volatility and evolving compliance expenses. Nonetheless, the transparency of public blockchains allows firms such as Arkham Intelligence, Chainalysis, and Elliptic to track on-chain movements and monitor illicit flows. As coordination between exchanges, issuers, and law enforcement agencies improves, the time window for attackers to launder stolen assets will likely shrink. Meanwhile, protocols like THORChain face rising regulatory pressure to implement enhanced screening tools.
Ultimately, the rapid conversion pattern into ETH after a hack reflects not a preference for ETH as a long-term store of value, but rather the unique structural features that facilitate asset movement and make intervention difficult.
