ethereum ·
Binance Hacker Hunts for Exit Ramps as DeFi Exchanges Pause Markets
Wallets associated with the suspected Binance hack have been observed on Etherscan swapping stablecoins that can be frozen for Ethereum on decentralized exchanges.
These wallets acquired tens of thousands of ETH through Uniswap contracts and borrowed 19,762 ETH on Aave, utilizing approximately $60 million in USDT. Neither application showed any indication of a flaw.
As of 22:07 UTC, about 253,000 ETH, equating to roughly $570 million, remained in two wallets without any outgoing transfers, and ETH lacks an issuer capable of freezing it.
The attacker is using decentralized exchanges like Uniswap and Aave as exit points, exchanging stablecoins whose issuers can freeze for Ethereum which no one can.
One relay wallet received 20,940 ETH ($45.58 Million) from Uniswap’s UniswapX contract at 20:34 UTC. Other wallets received amounts such as 3,552 ETH (over $8 million) at 20:47, and roughly 18,085 ETH (around $41 million) in two separate batches.
Aave provided a second exit route; between 20:57 and 21:01 UTC, one wallet deposited $10 million and later $50 million in USDT, borrowing 3,271 ETH ($7.43 million) and subsequently 16,491 ETH ($37.47 million). This prompted cybersecurity expert Odysseas Lamtzidi, founder of Phylax Systems, to warn of “contagion in full effect.”
In response, Aave paused its V3 markets on the Ethereum mainnet, halting new borrowing and deposits. Kamino, a protocol on the Solana blockchain, also paused its Solana and Bitcoin markets as a precautionary measure, stating, “Out of an abundance of caution, we have temporarily paused borrowing in the SOL/BTC Market.”
Ripple co-CEO Yi He stated that Ripple has frozen about $200 million in RLUSD, alongside over $2 billion in USDT and USDC. Yi He wrote on X, “Thanks to the Ripple team for promptly freezing approximately 200 million. User Funds are SAFU.”
Earlier coverage
Reported by Decrypt.
