Binance Hacker Hunts for Exit Ramps as DeFi Exchanges Pause Markets
Compiled by KHAO Editorial — aggregated from 1 source. See llms.txt for citation guidance.
★ Tier-1 Source
The attacker behind the wallets draining Binance is using decentralized exchanges such as Uniswap and Aave as exits, swapping stablecoins that issuers can freeze for Ethereum that nobody can, according to Etherscan records for 10 wallets, eight of them labeled as exploiters.
Key facts
- A wallet labeled Exploiter 8 still held 195,460 ETH ($444.2 million) at 22:03 UTC, and another 57,891.77 ETH ($131.6 million) reached one labeled Exploiter 11, together about 253,000 ETH, or roughly
- The attacker also swapped 36 million RLUSD, Ripple’s dollar-backed stablecoin, for 15,439 ETH, while 52.54 million RLUSD remained unfrozen at the holding wallet, according to an on-chain update
- After the Bybit hack, North Korea’s Lazarus Group converted 84.45% of the stolen ETH to Bitcoin through Thorchain, a cross-chain swap network, per Bybit’s CEO
- Ripple has since frozen about $200 million, according to Binance co-CEO Yi He
Summary
Wallets tied to the suspected Binance hack received tens of thousands of ETH from Uniswap contracts and borrowed 19,762 ETH on Aave against about $60 million in USDT, with no sign of a flaw in either app. About 253,000 ETH, roughly $570 million, sat in two wallets with no outgoing transfers as of 22:07 UTC, and ETH has no issuer that can freeze it. Ripple has frozen about $200 million in RLUSD, per Binance co-CEO Yi He, on top of the more than $2 billion in USDT and USDC. Earlier today, wallets linked to the world’s largest crypto exchange were drained of at least $5.5 billion, with the total tally still climbing.