Suspected Binance hacker swaps freezable stablecoins for ETH via Uniswap and Aave
In brief
- Binance-linked wallets were drained of at least $5.5 billion, Decrypt reported, with the total still rising.
- Etherscan records show the suspected attacker swapping stablecoins for ETH via Uniswap and Aave.
- Tether and Circle stablecoins worth more than $2 billion had been frozen at the time of reporting.
- Aave froze its V3 Ethereum markets; Kamino paused its Solana and Bitcoin markets.
- Binance said it was investigating but did not confirm user funds were affected.
Why the stablecoins are moving into ETH
Security experts widely believed the exchange had been hacked, and Decrypt reported the incident stood to be the largest hack in the crypto industry's 18-year history. The drain was still climbing at the time of reporting.
Stablecoin issuers moved fast. Tether and Circle moved to blacklist the suspected attacker's addresses, and more than $2 billion of the two tokens had been frozen by stablecoin providers so far.
ETH has no issuer, so funds converted before a freeze lands are out of reach.
The swaps went through Uniswap, a decentralized exchange where trades settle automatically with no intermediary company in the middle.
What the Etherscan records show
Decrypt reviewed Etherscan records for 10 wallets (eight labeled as exploiters). One relay wallet received 20,940 ETH ($45.58 million) from Uniswap's UniswapX contract at 20:34 UTC, and another got 3,552 ETH (over $8 million) at 20:47 UTC. Two later wallets took in about 18,085 ETH (around $41 million) and about 16,498 ETH ($37.5 million) from Uniswap contracts in batches.
Aave got used too. Between 20:57 and 21:01 UTC, one wallet deposited $10 million and then $50 million in USDT on Aave and borrowed 3,271 ETH and then 16,491 ETH against it. Odysseas Lamtzidi, founder of Phylax Systems, warned of "contagion in full effect."
A wallet labeled Exploiter 8 held 195,460 ETH ($444.2 million) at 22:03 UTC. Exploiter 11 received 57,891.77 ETH ($131.6 million) after four hops in 28 minutes (Exploiter 4 through 5, 6 and 7). Together, the two held about 253,000 ETH, roughly $570 million.
DeFi protocols hit pause
Aave froze its V3 markets on Ethereum mainnet, blocking new deposits and borrowing. Kamino, a Solana-based defi protocol, paused its Solana and Bitcoin markets as a precaution and said in a statement that it's unaffected by the Binance situation.
Ripple's RLUSD is in the picture as well. Etherscan showed the main receiving wallet holding about $88.5 million in RLUSD at 20:41 UTC, and Binance co-CEO Yi He said on X that Ripple froze about $200 million.
"Ripple is closely monitoring reports of a potential exploit involving Binance and its attackers’ RLUSD holdings and we are actively freezing affected funds"
Jack McDonald, Ripple's senior vice president for stablecoins, said that in a statement.
Frequently asked questions
Why is the suspected Binance attacker swapping stablecoins for ETH?
Tether and Circle moved to blacklist the suspected attacker's addresses, and more than $2 billion of their stablecoins had been frozen at the time of reporting. ETH has no issuer, so funds converted to ETH before a freeze took effect were out of the issuers' reach, according to Decrypt.
How did Aave and Kamino respond to the Binance incident?
Aave froze its V3 markets on Ethereum mainnet, blocking new deposits and borrowing. Kamino, a Solana-based DeFi protocol, paused its Solana and Bitcoin markets as a precaution and said it was unaffected by the Binance situation.
