Bobby Lee, founder of Ballet Global, said the Bitcoin stolen in Binance’s reported $6.3 billion hack was probably impossible to recover: “That’s gone,” he told Bloomberg.
4 Some stablecoins were frozen, but a freeze stops funds from moving; it does not by itself transfer them back to Binance or reimburse customers.
55
60
Why Bitcoin and stablecoins have different recovery prospects
Some stablecoin issuers can block tokens under their control. Bitcoin has no token issuer with the same kind of issuer-level freeze mechanism, so Lee’s assessment was that the stolen BTC was likely beyond recovery.
4
26 That is a judgment about the practical difficulty of recovering the Bitcoin—not proof that no funds could ever be seized through investigation or legal action.
The distinction matters: freezing is an intervention, while recovery is a separate process. A frozen balance may still require coordination among law enforcement, exchanges and token issuers before it can be returned. A freeze should not be counted as a completed repayment.
60
What the reported freeze figures mean
The estimates are close in scale but not identical. Binance said about $3 billion had been frozen on-chain. Elliptic reported $2.84 billion in verified frozen funds, almost all USDT and USDC. TRM Labs counted roughly $2.7 billion frozen on-chain in its stated snapshot, including issuer freezes and an Arbitrum Security Council intervention.
2
25
55
These figures should not be added together: they are competing or differently timed tallies of frozen assets, not separate recoveries. TRM’s reporting also listed 18,270 BTC and more than 420,000 ETH still held by the attacker, valued at about $2.4 billion in one estimate.
51 “Beyond an issuer’s reach” is not the same as legally unrecoverable; it describes the limits of an issuer’s ability to block tokens.
TRM names Tether, Circle, Ripple and World Liberty Financial among the stablecoin issuers that froze funds. Its report also says Arbitrum’s Security Council froze 8,426 ETH and 74.6 million ARB on its network.
55 The supplied reporting does not substantiate a separate First Digital freeze, so no amount or action for that company can be confirmed here.
What is known—and not known—about the breach
Binance’s preliminary account said a potentially compromised DevOps engineer’s laptop may have provided access to a service container used to submit unauthorized withdrawals. The reporting also noted additional points of breach and no evidence of leaked private keys; these were preliminary findings, not a final explanation of the attack.
21
25
TRM’s report attributes the attack to North Korean actors, and other coverage says Chainalysis reached a similar attribution.
55
58 The available excerpts do not lay out the underlying attribution evidence or establish specific laundering routes, so those details should not be treated as confirmed here.
Binance’s promise is separate from recovering the stolen assets
Binance pledged to cover all losses, and reporting described the planned funding as coming from its SAFU fund and company funds.
2
25 That customer commitment is separate from whether investigators or asset issuers can recover the stolen coins. Binance also said withdrawals were expected to resume within 48 hours; that was a reported expectation, not evidence that the stolen assets had been returned.
46
Bloomberg reported a crypto selloff after the suspected hack.
33 A secondary report characterized Lee’s view as saying the market could withstand losses in the tens of billions, but the available account does not provide enough detail to verify his reasoning.
45 The supportable takeaway is narrower: some stablecoins were immobilized, the stolen Bitcoin was considered difficult to recover, and a freeze is not the same as a return of funds.