Wallets linked to a suspected Binance security incident have been used to move at least $5.5 billion in stolen cryptocurrency, with the total still climbing. Binance said it was investigating but did not confirm whether user funds were affected, though security experts widely believe the exchange was hacked.
The suspected attacker has targeted decentralized finance platforms as exit routes, converting stablecoins that can be frozen by their issuers into ethereum, which has no centralized issuer and cannot be frozen.
Stablecoin Freezes Underway
Tether and Circle moved quickly to blacklist the attacker's addresses, freezing over $2 billion in USDT and USDC combined. Ripple froze approximately $200 million in RLUSD, according to Binance co-CEO Yi He. However, ethereum converted before these measures remains out of reach.
DeFi Platforms Under Pressure
Uniswap, a decentralized exchange, processed multiple large ethereum transfers from the attacker's wallets. Between 20:34 and 21:01 UTC, four separate transactions moved roughly 62,000 ETH from Uniswap contracts, totaling approximately $141 million.
Aave, a lending protocol, became a second exit point. One wallet deposited $60 million in USDT and borrowed 19,762 ETH against it between 20:57 and 21:01 UTC. Following this activity, Aave froze its V3 markets on Ethereum mainnet, blocking new deposits and borrowing. Kamino, a DeFi protocol on Solana, also paused its SOL and BTC markets as a precautionary measure.
Ethereum Accumulating in Attacker Wallets
As of 22:07 UTC, approximately 253,000 ETH worth roughly $570 million sat in two wallets with no outgoing transfers. One wallet labeled as an exploiter held 195,460 ETH, while another held 57,891.77 ETH. The second pile of ethereum arrived through four intermediary wallets in 28 minutes.
The attacker also converted 36 million RLUSD for 15,439 ETH, with 52.54 million RLUSD remaining unfrozen at the holding wallet.
