Why Crypto Hackers Convert Stolen Funds Into Ethereum After Major Exploits

When hackers steal cryptocurrency, taking control of the assets is only the beginning. The next challenge is preventing the stolen funds from being frozen, traced or recovered. In many major crypto exploits, attackers respond by converting stolen tokens into Ethereum (ETH), often within minutes of the initial theft. This is not necessarily because they intend to keep the money in ETH. It is because the asset offers characteristics that make it useful during the early stages of moving stolen funds.

The strategy has become increasingly visible in major blockchain investigations. Attackers frequently target stablecoins and other tokens whose issuers have the technical ability to blacklist addresses. Once an address is blacklisted, the affected tokens may become impossible to transfer, even if the attacker still controls the private keys.

USDT and USDC are prominent examples. Tether and Circle maintain mechanisms that allow them to block specific addresses under certain circumstances, including suspected illicit activity and applicable legal requirements. Circle’s documentation explicitly describes how blocklisting prevents an address from sending or receiving USDC. Native ETH does not have an equivalent central issuer with authority to freeze individual balances.

Why ETH Is Attractive After a Crypto Hack

The first advantage is resistance to issuer-level freezing. Ethereum is secured by a decentralized network, and ETH is its native asset rather than a token issued by a company. There is no central ETH issuer with a blacklist function that can simply disable an attacker’s wallet. Converting stolen stablecoins into ETH therefore removes one important avenue through which an issuer could directly immobilize the funds.

However, this does not make ETH anonymous or immune to intervention. Ethereum transactions remain publicly visible, and exchanges, custodians and other service providers can restrict accounts associated with stolen funds. Authorities can also investigate and pursue assets through legal channels. The distinction is that ETH cannot be frozen through the same issuer-controlled token blacklist mechanism available to certain stablecoins.

The second advantage is the availability of decentralized exchanges and established trading infrastructure. Many exploits involve Ethereum-based tokens or applications operating on EVM-compatible networks. Attackers can sometimes exchange stolen tokens for ETH through decentralized exchanges and automated market makers without first transferring assets to a centralized exchange.

Speed is particularly important because stablecoin issuers and security investigators can react quickly once suspicious wallets are identified. Every additional minute creates an opportunity for funds to be frozen or intercepted. Attackers therefore have an incentive to convert vulnerable tokens before the relevant issuer activates its restrictions.

Liquidity is another major consideration. ETH is one of the most actively traded cryptocurrency assets, with extensive markets across decentralized and centralized platforms. This makes it easier to exchange substantial amounts than it would be with many smaller tokens. Nevertheless, large transactions can still produce significant slippage, especially when attackers prioritize speed over price.

ETH Is Often the Beginning, Not the End

The October 2026 Binance hack provides a particularly clear example. Blockchain analytics firm Elliptic reported that approximately $6.43 billion in assets was stolen, including $3.46 billion in stablecoins. Before issuers could freeze all the affected funds, attackers converted approximately $786 million in stablecoins into ETH and TRX. Tether froze a major receiving wallet 37 minutes after the stolen USDT arrived, while Circle froze the affected USDC.

The incident demonstrates why attackers treat the initial conversion as a race against time. Once stablecoins become ETH or another native asset, the direct issuer-freezing risk is reduced. But the money is not automatically clean, and the transaction history does not disappear.

After conversion, attackers may distribute funds across newly created wallets, use cross-chain bridges, interact with lending protocols or attempt to move assets through additional services. Each step can complicate investigations, but blockchain analytics firms can continue tracking transaction flows across addresses and networks.

ETH’s deep liquidity also comes with a trade-off: large swaps can be expensive. Elliptic’s analysis of the Binance incident found that some rushed stablecoin-to-ETH conversions involved substantial losses against market prices. Attackers effectively sacrificed value to move assets before freezing mechanisms took effect.

Ultimately, ETH is attractive because it combines broad market access, extensive decentralized exchange infrastructure and the absence of a central issuer-controlled freeze mechanism. It is not the only destination hackers use, and it does not guarantee that stolen funds will remain beyond recovery. Bitcoin and TRX can serve similar purposes in different circumstances.

For investigators, exchanges and token issuers, the critical window often begins immediately after the theft. For attackers, converting vulnerable tokens into assets that are harder to freeze is frequently an early priority. The subsequent movement of those assets is where the longer and more complicated laundering process begins.