Synthetix has announced the recovery of approximately $8.4 million in SNX tokens that were stolen during the recent $6.3 billion hack targeting Binance, the world’s largest cryptocurrency exchange by trading volume. The incident, identified as the largest exploit in crypto history, surpassed the previous record set by the $1.5 billion Bybit breach in February 2025.
Details of the Binance hack and response measures
Investigators have linked the attack to North Korea’s TraderTraitor unit. Binance has attributed the security breach to a compromised laptop belonging to a DevOps engineer. As a result of coordinated efforts across the industry, close to $3 billion in stolen assets have been frozen or isolated on various blockchains.
Major stablecoin issuers have played a crucial role in these efforts. Tether has blacklisted roughly $1.77 billion in USDT, while Circle has frozen about 825 million USDC. Ripple intervened to freeze 40.5 million RLUSD out of a total 88.5 million that was moved. World Liberty Financial has locked 27.8 million USD1.
| Platform/Token | Amount Frozen |
|---|---|
| Tether (USDT) | $1.77 billion |
| Circle (USDC) | $825 million |
| Ripple (RLUSD) | $40.5 million |
| World Liberty Financial (USD1) | $27.8 million |
Arbitrum’s Security Council utilized emergency powers to isolate $30.5 million in ETH and ARB. Additionally, decentralized exchange aggregator 1inch has blocked exploit-linked addresses from accessing its platform, including its wallet and API services.
Admin keys and asset recoverability
The effectiveness of asset recovery in incidents like this often hinges on the existence of admin keys or blacklist functions within a protocol or token. Issuers of certain centralized assets and some protocols—such as Arbitrum—are able to freeze or reverse transactions before reaching their intended recipients. By contrast, native assets like Ethereum’s ETH and Bitcoin’s BTC lack such mechanisms. Once transferred, these assets generally cannot be blocked or recovered by any central actor.
Some tokens are designed to be immutable, meaning they cannot be altered or frozen, but they can still be lost if mistakenly sent to inaccessible addresses. Reserve, the project behind the RSR token, reported that when the attacker acquired approximately 3.4 billion RSR, no intervention was possible since RSR lacks admin keys. Reserve noted publicly that not even its own team could freeze these tokens.
Tokens with freezing capabilities can be stopped, while immutable tokens may only be lost due to user error or intentional destruction.
Synthetix recovery and Newton’s loss
Synthetix, a decentralized finance protocol specializing in the creation of synthetic assets, confirmed that its protocolDAO had recovered the stolen SNX. The tokens are currently held in the protocolDAO’s multisignature Safe wallet. Synthetix stated it has already informed Binance and will return the recovered tokens upon request.
The SNX stolen from Binance is secured in the Synthetix protocolDAO Safe, and will be sent back to Binance upon request. Synthetix confirmed that Binance has been notified.
The attacker’s attempt to misappropriate Newton tokens (NEWT) backfired due to an operational error. According to the Newton Foundation, the perpetrator sent about 8 million NEWT—along with 17 other tokens including ANIME—to NEWT’s own contract address on Ethereum, making those tokens irretrievable. With no mechanism to withdraw assets from that contract, approximately $3.5 million in NEWT is now permanently inaccessible.
Mini dictionary: Synthetix protocolDAO — A decentralized autonomous organization responsible for managing upgrades, security, and key aspects of the Synthetix protocol, including treasury and emergency actions.
Unrecoverable funds and market impact
The attackers have shifted their focus toward converting centrally frozen tokens into cryptocurrencies that cannot be locked by third parties. Approximately $158.25 million was raised by selling altcoins such as AAVE, LINK, and PEPE. These proceeds were funneled primarily into ether (ETH).
In a notable move just 41 minutes before Aave froze the market, the attackers supplied 60 million USDT to Aave and borrowed around 19,762 ETH against that collateral. The ETH, unlike stablecoins, could not be frozen and thus was successfully withdrawn. Tracking from blockchain analytics firms Arkham and Lookonchain reports that around $2.86 billion in stolen assets remain beyond the reach of freezing or recovery mechanisms. This includes $1.09 billion in ETH, $1.41 billion in BTC, and 682.9 million TRX.
| Asset | Amount | Status |
|---|---|---|
| ETH | $1.09 billion | Unfreezable |
| BTC | $1.41 billion | Unfreezable |
| TRX | 682.9 million | Unfreezable |
In response to the incident, Binance has suspended deposits and withdrawals. The exchange has assured users that losses will be covered using its SAFU (Secure Asset Fund for Users) reserves and company funds. Co-CEO Richard Teng stated on X, “Your money is safe and we’re covering every loss.”
