TL;DR:
Asset recovery: Synthetix’s protocolDAO rescued the stolen SNX tokens, valued at approximately $8.4 million, securing them in its multisig Safe.
Attacker’s operational error: Around 8 million NEWT tokens (worth nearly $3.5 million) were irreversibly trapped after being transferred directly to the token contract itself.
Binance exploit overview: Out of the $6.3 billion stolen in the exploit, issuers and protocols have frozen or immobilized nearly $3 billion across various networks.
Just 24 hours later, Synthetix recovers the SNX tokens stolen during the $6.4 billion hack against Binance , securing the funds for restitution. On the same day, a technical error by the perpetrator left millions of Newton tokens locked without any possibility of recovery.
The SNX stolen from Binance has been recovered by the Synthetix protocolDAO.
The tokens are secured in the protocolDAO Safe and will be sent back to Binance on request. We have notified Binance.
Fuck Kim Jong Un. https://t.co/Od9S69xuN3
— Synthetix (@synthetix) October 30, 2026
Through a post on X, Synthetix’s decentralized autonomous organization confirmed the full recovery of the tokens belonging to the exchange. The funds remain under custody in the protocol’s multisig contract (Safe multisig), pending a formal request from Binance to execute the return transfer.
For its part, the Newton Foundation reported an inadvertent incident that rendered part of the stolen loot unusable. The attacker transferred approximately 8 million NEWT tokens directly to the coin’s smart contract on the Ethereum network. Lacking internal functions for the release or extraction of assets, these funds became immobilized beyond the control of any entity or the hacker themselves.
Massive freezes and technical limitations against immutable assets
The Binance attack represents the largest exploit recorded in the crypto industry. Several on-chain security researchers have operationally linked the incident to the North Korean unit known as TraderTraitor.
Faced with the sheer volume stolen, centralized stablecoin issuers executed immediate freezes across multiple chains. According to on-chain records, Tether blacklisted approximately $1.77 billion in USDT , while Circle froze around $825 million in USDC. These measures were joined by Ripple, with the retention of $40.5 million in RLUSD out of the $88.5 million moved , and World Liberty Financial, which immobilized $27.8 million in USD1.
Additionally, the Arbitrum Security Council activated its emergency powers to isolate $30.5 million in ETH and ARB . Simultaneously, decentralized aggregator 1inch moved to block the attacker’s addresses across its web interface, wallets, and API endpoints.
This containment capability stems from the presence of admin keys and blacklisting functions built into centralized smart contracts. Tokens designed under strict immutability parameters do not permit interventions of this nature. An example reported by the Reserve team on X highlighted that the 3.4 billion stolen RSR tokens could not be stopped due to the complete absence of administrative control keys.
The attacker has carried out strategic conversions to bypass containment measures. Tracking reports provided by Arkham and Lookonchain indicate the sale of positions in AAVE, LINK, and PEPE valued at an estimated $158.25 million, which were swapped into ether. Furthermore, the attacker deposited $60 million in USDT into the Aave protocol to borrow 19,762 ETH, just 41 minutes before the platform’s market was paused.
According to tracking by Arkham and Lookonchain, approximately $2.86 billion remains in assets lacking freeze mechanisms, broken down into $1.41 billion in BTC, $1.09 billion in ETH, and $682.9 million in TRX.
Binance continues to suspend deposit and withdrawal services across its platform while internal security audits conclude. The exchange’s management confirmed that user asset losses will be fully covered using corporate funds and SAFU reserve resources.
