Binance Hacker Hunts for Exit Ramps as DeFi Exchanges Pause Markets

The attacker behind the wallets draining Binance is using decentralized exchanges such as Uniswap and Aave as exits, swapping stablecoins that issuers can freeze for Ethereum that nobody can, according to Etherscan records for 10 wallets, eight of them labeled as exploiters.

Earlier today, wallets linked to the world’s largest crypto exchange were drained of at least $5.5 billion, with the total tally still climbing. The company said it was investigating the security incident but did not confirm user funds were affected, though security experts widely believe the exchange was indeed hacked. It stands to be the largest hack in the crypto industry’s 18-year history.

Stablecoin issuers Tether and Circle moved quickly to blacklist the suspected attacker’s addresses in order to freeze a portion of the funds and make them inaccessible. As centralized issuers, they each have the ability to blacklist addresses so their tokens cannot move, and more than $2 billion of those two tokens have been frozen so far by different stablecoin providers. ETH has no issuer, so every dollar converted before a freeze lands is out of their reach.

The swaps run through Uniswap, a decentralized exchange where trades settle automatically with no company in the middle.

BitcoinBTC · USD

$76,882−5.5%

24H7D1M1YYTD

Oct 23Oct 24Oct 26Oct 28Oct 30

$82.0k$80.3k$78.6k$76.9k

24h HighHigh$81,840

24h LowLow$77,753

VolVol$2.2B

→

$50$100$500

Buy

One relay wallet received 20,940 ETH ($45.58 Million) from Uniswap’s UniswapX contract at 20:34 UTC, another got 3,552 ETH (over $8 million) at 20:47, and two later wallets took in about 18,085 ETH (around $41 million) from Uniswap contracts, in 7,444 ETH and 10,642 ETH batches, and about 16,498 ETH ($37.5 million), in 6,946 ETH and 9,552 ETH batches.

Aave, a lending app where users deposit crypto as collateral to borrow other coins, offered a second exit. Between 20:57 and 21:01 UTC, one wallet deposited $10 million and then $50 million in USDT and borrowed 3,271 ETH ($7.43 million) and then 16,491 ETH ($37.47 million) against it, which prompted cybersecurity experts Odysseas Lamtzidi, founder of Phylax Systems, to warn of “contagion in full effect.”

Aave has since frozen its V3 markets on Ethereum mainnet, which blocks new deposits and borrowing.

Kamino, a decentralized finance protocol built on the Solana blockchain, also paused its Solana and Bitcoin markets as a precautionary measure.

The ETH is piling up rather than moving on. A wallet labeled Exploiter 8 still held 195,460 ETH ($444.2 million) at 22:03 UTC, and another 57,891.77 ETH ($131.6 million) reached one labeled Exploiter 11, together about 253,000 ETH, or roughly $570 million. That second pile arrived after four hops in 28 minutes, from Exploiter 4 to 5, 5 to 6, 6 to 7 and 7 to 11.

The attacker also swapped 36 million RLUSD, Ripple’s dollar-backed stablecoin, for 15,439 ETH, while 52.54 million RLUSD remained unfrozen at the holding wallet, according to an on-chain update circulating on X. Etherscan showed the main receiving wallet holding about $88.5 million in RLUSD at 20:41 UTC, which matches the two figures combined.

Ripple has since frozen about $200 million, according to Binance co-CEO Yi He. “Thanks to the Ripple team for promptly freezing approximately 200 million. User Funds are SAFU,” a reference to the exchange’s emergency reserve fund, Yi He wrote on X.

“Ripple is closely monitoring reports of a potential exploit involving Binance and its attackers’ RLUSD holdings and we are actively freezing affected funds,” Jack McDonald, Ripple’s senior vice president for stablecoins, said in a statement. “We’re coordinating with relevant parties and stand ready to support any investigation and appropriate action to keep users protected.”

Tornado Cash, a mixer that scrambles the trail of crypto payments, appears so far only as funding for the address that set up the attack.

After the Bybit hack, North Korea’s Lazarus Group converted 84.45% of the stolen ETH to Bitcoin through Thorchain, a cross-chain swap network, per Bybit’s CEO. Monero, a privacy coin that hides who sent what, rose about 6% on Thursday, suggesting a possible rotation into the privacy coin.