The $2.85B Binance hackers lost shows why the UK needs stablecoin freeze rules

Opinion by Lissele Pratt, co-founder, Capitalixe

Last weekend, the Federal Bureau of Investigation claimed that North Korea was behind the $6.3 billion Binance hack, which analysts are calling the largest heist on record.

While I’ve read a lot about the scale of this heist, far less has been said about what went right.

Because while it is true that the perpetrators stole $6.3 billion, they haven’t actually been able to hold on to a significant proportion of those takings. $2.85 billion of the funds has been frozen.

The reason for this comes down to what the stolen money was comprised of. Of that $2.85 billion, 94% was held in stablecoins.

While this hack was terrible news all around, it did show that centralized control, oftentimes criticized by crypto purists, might actually be one of the strongest tools we have against crypto crime.

Because, unlike other assets, stablecoins can be frozen by their issuers, giving victims a real chance to stop stolen money reaching the wrong hands.

It does, however, raise an uncomfortable question. If private companies have the power to freeze billions of dollars in assets, who decides when they should be allowed to use it?

The United Kingdom now has the opportunity to do just that.

To get an idea of just how much the freeze mattered, you just have to look at what the hackers did within the first hour of their heist.

Related: Binance, Polymarket seek Polygon hard fork to recover $6.8M in stolen crypto

Clearly, they understood that there was a very limited window to move the stablecoins before anyone could stop them. So that’s exactly what they did.

What was frozen from the Binance hack. Source: Elliptic

Less than an hour after the hack began, they had already sold $325 million worth of stolen USDT (Tether’s stablecoin) for Ether. The reasoning behind this was to swap an asset that could be frozen with one that could not.

Luckily, stablecoin issuers were quick to act, with Tether’s first major freeze coming just 37 minutes after the stolen funds reached the hackers’ main wallet, and Circle following three minutes later, blocking the movement of USDC.

Without Tether and Circle intervening, far more of the funds could have ended up beyond their reach.

The freeze, to its credit, worked for the most part because a handful of companies decided, in real time, to use it.

The problem is that there still isn’t an agreed standard that outlines when a freeze is justified or how quickly the response needs to be, and we’re beginning to see the consequences of not having these answers.

For instance, Circle is facing a proposed class action from Drift Protocol investors who allege it failed to freeze around $230 million in stolen USDC after the April hack. Their argument is that Circle could have stopped the money from moving, but didn’t act in time.

Meanwhile, Tether is being sued in New York by two businessmen who claim it froze millions of their assets months before a seizure warrant existed. It’s important to mention that Tether has responded to this case, calling these allegations baseless.

Working in payments and banking, it’s not uncommon for me to see traditional banks freeze money and accounts. Due to this, you may argue that if a bank can do this frequently, why shouldn’t a stablecoin issuer be able to?

Stablecoin freeze timeline. Source: CertiK

My argument isn’t that they shouldn’t. But banks don’t get to decide they want to freeze assets out of nowhere. There’s usually a legal trigger behind their decision, as well as a way to challenge it.

Stablecoin issuers now hold the same power while having to act faster and across borders. So it’s about time they’re given some structure.

There is, however, a caveat with regulating stablecoin issuers. Tether and Circle, two of the largest issuers, aren’t based in the UK, so British regulators can’t simply tell them what to do.