Synthetix DAO Recovers $8.4M in SNX From Binance Hack

At Least Nine Moves Against a $6.3B Haul

The protocolDAO behind Synthetix Network has recovered the Synthetix (SNX) tokens stolen from Binance, securing roughly $8.4 million worth of the recovered supply in its multisignature Safe. In an official post on Friday, the DAO said Binance has been notified and the tokens will go back on request, without setting a date for the transfer. A multisignature Safe needs several independent approvals before funds can move, so the recovered SNX now sits in a structure no single party controls. The clawback is one of at least nine counter-moves recorded against a haul Binance has confirmed at about $6.3 billion, more than four times the $1.5 billion Bybit hack of February 2025, the previous record. Investigators have tied the attack to North Korea's TraderTraitor unit, and Binance has blamed a compromised DevOps engineer's laptop for the initial access. Nearly $3 billion of the stolen money has been frozen or locked across chains so far, with centralized stablecoin issuers responsible for the largest shares. The recovery stands out because it came from the token's own DAO rather than a stablecoin issuer's blacklist. SNX is the governance token of a derivatives protocol that helped pioneer perpetual futures trading on-chain, and that same DAO-level control over its own supply is what made the clawback possible. Binance has suspended deposits and withdrawals and says its SAFU reserve and company funds will cover user losses, a pledge co-CEO Richard Teng made in writing: “Your money is safe and we’re covering every loss.” Our live monitoring shows the SNX price down about 8.4% over the past 24 hours, a slide that tracks the wider market rather than the recovery itself; the levels below the market are being followed in the SNX technical analysis.

The freeze ledger behind that near-$3 billion total reads like a roll call of token issuers. Tether has blacklisted about $1.77 billion in USDT and Circle about $825 million in USDC. Ripple froze 40.5 million RLUSD out of the 88.5 million that moved, and World Liberty Financial locked up 27.8 million USD1. Arbitrum's Security Council used its emergency powers to fence off $30.5 million held in ETH and ARB, while the aggregator 1inch blocked the exploit addresses across its apps, wallet and API. Every one of those actions leans on the same mechanism: a blacklist function, or admin key, that lets an issuer or any controlling DAO stop or reverse a transfer before it reaches its destination. Native assets carry no such switch. Ether and Bitcoin have no issuer and no off button, which is why they dominate the still-unfrozen share of the haul. Tokens that are immutable by design cannot be frozen, but they can still be lost. Reserve hit that limit when the thief grabbed about 3.4 billion RSR; the team said that nobody, including the project itself, could freeze them, because RSR ships with no admin keys. Newton's tokens survived through the attacker's own error. The Newton Foundation's post said the thief sent roughly 8 million NEWT directly to the token's own contract address, together with 17 other tokens including ANIME. NEWT is an ERC-20 token on Ethereum whose supply is capped at 1 billion, and because the receiving contract has no function to release tokens, the roughly $3.5 million in NEWT is stranded for good. Unlike a freeze, which an issuer can lift, a transfer into a contract with no exit is as close to permanent as on-chain custody gets.

The $2.86B No Admin Key Can Reach

On-chain data shows where the recoverable share ends. The attacker has been converting freezable assets into ones no key can reach: roughly $158.25 million raised from selling altcoin holdings including AAVE, LINK and PEPE was funneled into ETH, and 60 million USDT supplied to Aave, one of DeFi's largest lending markets by total value locked, collateralized a loan of about 19,762 ETH taken 41 minutes before the market was frozen. About $2.86 billion of the haul, including $1.09 billion held in ETH, $1.41 billion in Bitcoin, and a further 682.9 million TRX, sits outside every known freeze function. In our reading, the Synthetix clawback and the stranded NEWT prove the same rule from opposite sides: recovery stops where token design does. With close to $3 billion frozen against the $6.3 billion stolen, the unfrozen remainder is where the next round of counter-moves will land. Readers reassessing exposure to the affected venue can start with our Binance guide.