Binance Hacker Seeks Exit as DeFi Markets Freeze

The perpetrator behind the mass draining of Binance wallets is reportedly utilizing decentralized exchanges like Uniswap and Aave to convert stolen stablecoins into Ethereum, a cryptocurrency that cannot be frozen by issuers. This strategy, revealed by Etherscan records for ten wallets, eight of which are identified as exploiters, aims to move funds beyond the reach of stablecoin providers.

The security incident, which began earlier today, saw wallets linked to the world’s largest cryptocurrency exchange drained of at least $5.5 billion, with the total amount still increasing. Binance has stated it is investigating the breach but has not confirmed if user funds were impacted, though security experts widely believe the exchange was indeed hacked. If confirmed, this would represent the largest hack in the crypto industry’s 18-year history.

Stablecoin issuers Tether and Circle have moved swiftly to blacklist the suspected attacker’s addresses, effectively freezing a portion of the illicitly obtained funds. As centralized entities, they possess the capability to block transactions of their tokens. To date, over $2 billion in Tether and Circle tokens have been frozen by various stablecoin providers. Ethereum, however, lacks a central issuer, meaning any ETH converted before a freeze is implemented is effectively irretrievable.

The conversion process is reportedly occurring on Uniswap, a decentralized exchange that facilitates automatic trade settlements without intermediary involvement.

One intermediary wallet received 20,940 ETH (approximately $45.58 million) from Uniswap’s UniswapX contract at 20:34 UTC. Another received 3,552 ETH (over $8 million) at 20:47 UTC. Subsequently, two other wallets acquired roughly 18,085 ETH (around $41 million) from Uniswap contracts, broken down into batches of 7,444 ETH and 10,642 ETH, and another 16,498 ETH ($37.5 million) in batches of 6,946 ETH and 9,552 ETH.

Aave, a lending platform where users deposit cryptocurrency as collateral to borrow other digital assets, has also served as an exit point. Between 20:57 and 21:01 UTC, one wallet deposited $10 million and then $50 million in USDT. Against this collateral, the wallet borrowed 3,271 ETH ($7.43 million) and then 16,491 ETH ($37.47 million). This activity prompted cybersecurity expert Odysseas Lamtzidi, founder of Phylax Systems, to warn of “contagion in full effect.”

Aave Freezes Markets

In response to the unfolding situation, Aave has since frozen its V3 markets on the Ethereum mainnet, preventing new deposits and borrowing activities.

Kamino, a decentralized finance protocol operating on the Solana blockchain, has also temporarily paused its Solana and Bitcoin markets as a precautionary measure.

Attacker Amasses Ethereum

The stolen Ethereum is accumulating rather than being dispersed. At 22:03 UTC, a wallet labeled “Exploiter 8” still held 195,460 ETH (approximately $444.2 million). Another wallet, “Exploiter 11,” received 57,891.77 ETH ($131.6 million), bringing their combined holdings to roughly 253,000 ETH, or about $570 million. This latter sum arrived after a rapid series of four transfers within 28 minutes, moving from “Exploiter 4” to “Exploiter 5,” then to “Exploiter 6,” “Exploiter 7,” and finally to “Exploiter 11.”

Ripple Freezes Funds

The attacker also converted $36 million worth of RLUSD, Ripple’s dollar-backed stablecoin, into 15,439 ETH. According to an on-chain update circulating on X, 52.54 million RLUSD remained unfrozen in the holding wallet. Etherscan data from 20:41 UTC showed the main receiving wallet holding approximately $88.5 million in RLUSD, consistent with the combined figures.

Binance co-CEO Yi He confirmed that Ripple has frozen approximately $200 million. “Thanks to the Ripple team for promptly freezing approximately 200 million. User Funds are SAFU,” Yi He wrote on X, referencing the exchange’s emergency reserve fund.

Jack McDonald, Ripple’s senior vice president for stablecoins, stated, “Ripple is closely monitoring reports of a potential exploit involving Binance and its attackers’ RLUSD holdings and we are actively freezing affected funds. We’re coordinating with relevant parties and stand ready to support any investigation and appropriate action to keep users protected.”

Tornado Cash and Potential North Korean Involvement

Tornado Cash, a cryptocurrency mixer designed to obscure transaction trails, appears to have only been used to fund the address that initiated the attack.

Following a previous hack of Bybit, North Korea’s Lazarus Group reportedly converted 84.45% of the stolen ETH into Bitcoin via Thorchain, a cross-chain swap network, according to Bybit’s CEO. The privacy coin Monero saw a price increase of about 6% on Thursday, suggesting a potential shift of funds into privacy-focused cryptocurrencies.