Suspected hackers connected to a major security breach at Binance have moved tens of thousands of ETH through decentralized platforms, including Uniswap and Aave, according to transaction records on Etherscan. Security experts identified at least ten wallets involved, with eight labeled as exploiters.
Large-scale fund movements and DeFi exits
Earlier today, wallets linked to Binance, one of the world’s largest cryptocurrency exchanges, were drained of more than $5.5 billion. The total loss appears to be growing, while Binance continues to investigate the incident. The exchange has not officially confirmed if user funds have been directly affected. However, numerous cybersecurity analysts believe a hack is likely responsible.
Stablecoin issuers acted quickly in response to the breach. Tether and Circle both blacklisted addresses associated with the suspected attacker, freezing more than $2 billion worth of USDT and USDC collectively. As centralized issuers, both companies are able to restrict movement from specific wallet addresses.
In contrast, Ethereum, which has no central issuer capable of freezing assets, enabled the attacker to convert stablecoins to ETH and move these funds beyond the reach of stablecoin companies.
Blockchain records showed several notable transactions. A relay wallet received 20,940 ETH, valued at $45.58 million, from Uniswap’s UniswapX contract. Another wallet collected 3,552 ETH, over $8 million, followed by additional transfers totaling about 18,085 ETH ($41 million) split into two tranches of 7,444 and 10,642 ETH, and further 16,498 ETH ($37.5 million) across batches of 6,946 and 9,552 ETH.
Aave, a decentralized lending platform, offered another avenue for the attacker. Records indicate one wallet deposited $10 million and $50 million in USDT between 20:57 and 21:01 UTC, borrowing 3,271 ETH ($7.43 million) and then 16,491 ETH ($37.47 million). Odysseas Lamtzidi, founder of cybersecurity firm Phylax Systems, described the situation as “contagion in full effect.”
Mini dictionary: Aave is a decentralized financial protocol that allows users to lend and borrow cryptocurrencies without an intermediary, using smart contracts to manage deposits and collateralized loans.
Following the breach, Aave froze its V3 markets on the Ethereum mainnet, halting new deposits and borrowing activities.
Impact on other platforms and asset tracking
Kamino, a decentralized finance protocol built on the Solana blockchain, temporarily paused its Solana and Bitcoin markets as a precaution. The protocol stated it was not affected by the Binance incident and continues to monitor developments in coordination with partners.
As the transactions unfolded, about 253,000 ETH—approximately $570 million as of 22:07 UTC—remained in two wallets with no outgoing transfers detected. A wallet labeled Exploiter 8 held 195,460 ETH ($444.2 million), and another wallet, Exploiter 11, received 57,891.77 ETH ($131.6 million) after a series of internal transfers.
| Wallet Label | ETH Holdings | USD Value | Time (UTC) |
|---|---|---|---|
| Exploiter 8 | 195,460 ETH | $444.2 million | 22:03 |
| Exploiter 11 | 57,892 ETH | $131.6 million | 22:07 |
The attacker also used Uniswap to swap 36 million RLUSD, Ripple’s recently launched stablecoin, for 15,439 ETH. At the same time, 52.54 million RLUSD remained unfrozen in the holding wallet. As of 20:41 UTC, the main receiving address held about $88.5 million worth of RLUSD.
Ripple and emergency response measures
Ripple, best known for its digital payment solutions, took additional steps and froze approximately $200 million in RLUSD in collaboration with Binance. The move was confirmed by Binance co-CEO Yi He, who expressed appreciation for the action and assured users that funds held by Binance’s emergency reserve remain secure.
Ripple is closely monitoring reports of a potential exploit involving Binance and the attackers’ RLUSD holdings and is actively freezing affected funds. Coordination with relevant parties is ongoing to support investigations and ensure user protection, according to statements by Ripple’s senior vice president for stablecoins, Jack McDonald.
So far, the stablecoin freezes have been effective in limiting the attacker’s ability to move funds, but every dollar converted into ETH is now beyond the reach of centralized controls.
Notably, Tornado Cash, a mixing protocol often used to obscure transaction trails, appears to have been utilized only during the funding phase of the attack but has not been directly linked to the outflow of the stolen funds.
Mini dictionary: Tornado Cash is a decentralized protocol that enables users to break the link between the sender and receiver address on Ethereum by pooling and ‘mixing’ deposits, making transaction tracing significantly more difficult.
