ReportedfreezeStatement 19
21:01 | Tether freezes 971.1M USDT, 37 minutes after the Ethereum transaction.
The page states that Tether froze 971.1M USDT at 21:01 UTC, 37 minutes after the Ethereum transaction.
This line is our short summary of the quote below. The quote is the evidence.
Flagged as conflicting
- Hacken's timeline shows Tether freezing 971.1M USDT at 21:01 (UTC). Chainalysis says issuers began freezing by 5:14 p.m. ET, which is 21:14 UTC if Eastern Daylight Time is meant. Compare with Chainalysis said stablecoin issuers began freezing funds by 5:14 p.m. ET on 29 October. (Chainalysis). Side by side
- Hacken's timeline (statement 19) lists Tether freezing 971.1M USDT at 21:01 UTC, 37 minutes after the Ethereum transaction. Elliptic (statement 92) says Tether froze the main attacker Ethereum wallet 37 minutes after 20:24 UTC, "locking 1.18 billion USDT in place". Both put the freeze at the same moment and give different amounts. TRM (statement 143) says Tether froze 971.1 million USDT in that wallet at 21:01 and that later sweeps landed in the frozen wallet, which now holds 1.175 billion USDT. The Elliptic text we hold does not say whether its 1.18 billion includes those later sweeps. Shown side by side, not reconciled. Compare with Elliptic said the stolen USDT reached the attacker's main Ethereum wallet at 20:24 UTC, that Tether froze that wallet 37 minutes later locking 1.18 billion USDT, and that Circle froze the 823 million USDC in the same wallet three minutes after that. (Elliptic). Side by side
Figures from this statement
- Frozen USDT: 971,100,000 USDT as of
Other statements from the same source
ReportedattributionStatement 912
Hacken wrote that no government had confirmed anything, whereas after the Bybit theft the FBI named North Korea within five days.
Finally, no government has confirmed anything, whereas after the Bybit theft the FBI named North Korea within five days .
ReportedattributionStatement 911
Hacken wrote that the root cause is still unpublished, which, it wrote, "that firm" calls "the most diagnostic fact still missing". The passage follows Hacken's link to an Elliptic analysis, which it calls "the most careful reading".
None of this is proof, and the most careful reading explains why. The overlap with Bitget is small, about $39,000 of Binance funds at the shared address against about $510,000 from Bitget, and that shows a shared laundering network, not necessarily the same hackers. The thief also left most of the stolen USDT unconverted for 37 minutes on Ethereum and 46 on Tron, where North Korean groups usually move faster. The laundering through market makers and lending protocols doesn't match the older pattern either, and the root cause is still unpublished, which that firm calls "the most diagnostic fact still missing."
Reportedroot causeStatement 326
Hacken, quoting investigators, said the most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains.
The most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains.
Reportedroot causeStatement 325
Hacken said early signs on Ethereum pointed to phishing of the authorizations, which could explain Ethereum but none of the other chains.
Early signs on Ethereum pointed to phishing of the authorizations, which could explain Ethereum but none of the other chains.
ReportedotherStatement 324
Hacken recommended that wallet operators cap value and rate per wallet at the signer and hold new destinations for a second approval.
Cap value and rate per wallet at the signer and hold new destinations for a second approval