- Published on
Binance Hacker Hunts for Exit Ramps as DeFi Exchanges Pause Markets
- Authors
- Name
- DeepHorus
Wallets tied to the suspected Binance exploit are converting stablecoins into Ethereum through decentralized exchanges, Etherscan records show. Ten wallets are tracked, eight labeled exploiters. The attacker moved at least $5.5 billion from Binance-linked wallets, and the tally is still climbing. Binance said it was investigating but did not confirm user funds were affected; experts widely believe it suffered crypto’s largest hack.
Tether and Circle blacklisted suspect addresses, freezing more than $2 billion in USDT and USDC. Ripple later froze about $200 million in RLUSD, Binance co-CEO Yi He said. Because ETH has no issuer, converted funds cannot be frozen centrally.
Between 20:34 and 20:47 UTC, relay wallets received 20,940 ETH, worth $45.58 million, and 3,552 ETH, over $8 million, from Uniswap contracts. Two later wallets took about 18,085 ETH and 16,498 ETH from Uniswap. One wallet deposited $10 million and $50 million in USDT on Aave and borrowed 3,271 ETH and 16,491 ETH.
Aave froze its V3 Ethereum markets, blocking new deposits and borrowing. Kamino paused SOL/BTC borrowing on Solana as a precaution, saying it was unaffected. Experts warned of contagion. Odysseas Lamtzidi of Phylax Systems said "contagion in full effect."
By 22:03 UTC, Exploiter 8 held 195,460 ETH, $444.2 million. Exploiter 11 held 57,891.77 ETH, $131.6 million. Together they held about 253,000 ETH, roughly $570 million, with no outgoing transfers as of 22:07 UTC.
The attacker swapped 36 million RLUSD for 15,439 ETH. Another 52.54 million RLUSD remained unfrozen at a holding wallet, per an on-chain update. Etherscan showed the main receiving wallet held about $88.5 million in RLUSD at 20:41 UTC.
The case highlights DeFi tension: permissionless markets offer exits stablecoin issuers cannot freeze. Aave’s freeze may slow borrowing, but Ethereum transfers remain unstoppable. Investigators and issuers will likely trace wallets and blacklist addresses as funds move.
