Binance Hack Suspect Seeks Crypto Exit Routes as DeFi Markets Pause

Table of Contents

• You might want to know
• Main Topic
• Key Insights Table
• Afterwards...

You might want to know

• Why did the suspected attacker turn to decentralized exchanges and lending markets?
• What can stablecoin issuers freeze, and why is Ethereum more difficult to stop?

Main Topic

Wallets linked to a suspected hack involving Binance have been moving through decentralized finance platforms as the attacker appears to seek ways to convert and potentially move assets. On-chain records show funds passing through Uniswap and Aave, while stablecoin issuers have blacklisted addresses and frozen substantial amounts of tokens. The activity has prompted some DeFi protocols to pause markets as a precaution, even though no evidence in the reported transactions indicates a flaw in Uniswap or Aave.

Earlier today, wallets associated with the world’s largest crypto exchange were reportedly drained of at least $5.5 billion, with the estimated total continuing to rise. Binance said it was investigating a security incident but did not confirm that customer funds were affected. Security experts widely believe the exchange was hacked. If confirmed, the incident would be the largest hack in the crypto industry’s 18-year history.

The suspected attacker’s transactions are being tracked through 10 wallets, eight of which Etherscan labels as exploiters. The movement illustrates a key difference between centralized stablecoins and Ethereum. Tether and Circle can blacklist addresses, preventing their tokens from moving. ETH, by contrast, has no issuer with the ability to freeze it. Every stablecoin amount converted into ETH before a freeze can no longer be frozen by the stablecoin issuer.

Uniswap has been one route for those conversions. Trades on the decentralized exchange settle automatically through smart contracts, rather than through a company that handles each transaction. One relay wallet received 20,940 ETH ($45.58 Million) from Uniswap’s UniswapX contract at 20:34 UTC. Another received 3,552 ETH (over $8 million) at 20:47 UTC. Two later wallets received about 18,085 ETH (around $41 million) from Uniswap contracts, in transfers of 7,444 ETH and 10,642 ETH, and about 16,498 ETH ($37.5 million), in transfers of 6,946 ETH and 9,552 ETH.

These transfers show how decentralized exchanges can facilitate asset swaps without a centralized operator approving each transaction. That does not mean the platforms themselves were reported to have been exploited. Rather, the transactions used their ordinary functionality to exchange assets. The distinction is important: a protocol can be used as part of an attacker’s route without having suffered a security breach.

Aave provided another possible route. The lending app allows users to deposit crypto as collateral and borrow other assets against it. Between 20:57 and 21:01 UTC, one wallet deposited $10 million and then $50 million in USDT, borrowing 3,271 ETH ($7.43 million) and then 16,491 ETH ($37.47 million) against the deposits.

The borrowing activity drew attention from cybersecurity experts. Odysseas Lamtzidi, founder of Phylax Systems, warned of “contagion in full effect” in a post dated October 29, 2026. The concern was not limited to the original suspected breach: large-scale activity involving collateral, borrowing, and asset conversion can create risks for related markets and protocols, even when those systems are not themselves compromised.

Aave subsequently froze its V3 markets on Ethereum mainnet, blocking new deposits and borrowing. Kamino, a decentralized finance protocol on Solana, also paused its Solana and Bitcoin markets as a precaution. Kamino said it was unaffected by the ongoing Binance situation, but had temporarily paused borrowing in the SOL/BTC Market while monitoring developments and communicating with partners. These measures show how protocols may limit new activity when a fast-moving incident creates uncertainty about exposures.

Despite the swaps and borrowing, large amounts of ETH appeared to remain in attacker-linked wallets rather than moving onward. At 22:03 UTC, a wallet labeled Exploiter 8 held 195,460 ETH ($444.2 million). Another 57,891.77 ETH ($131.6 million) reached a wallet labeled Exploiter 11. Together, the holdings amounted to about 253,000 ETH, or roughly $570 million. As of 22:07 UTC, the two wallets had no outgoing transfers recorded.

The second group of funds had arrived through a sequence of four transfers in 28 minutes: from Exploiter 4 to Exploiter 5, then to Exploiter 6, from there to Exploiter 7, and finally to Exploiter 11. Such movements can make it harder to follow a transaction trail, but public blockchain records still expose transfers and balances. The on-chain visibility does not, by itself, establish who controls a wallet or what the holder intends to do next.

Stablecoin issuers responded by blacklisting suspected attacker addresses. Tether and Circle moved quickly to make some funds inaccessible, and more than $2 billion in USDT and USDC had been frozen by different stablecoin providers. Ripple also froze funds connected to RLUSD, its dollar-backed stablecoin. Binance co-CEO Yi He said Ripple had frozen about $200 million, adding that “User Funds are SAFU,” a reference to Binance’s emergency reserve fund.

Ripple’s senior vice president for stablecoins, Jack McDonald, said the company was monitoring reports of a potential exploit involving Binance and the attackers’ RLUSD holdings. He said Ripple was actively freezing affected funds, coordinating with relevant parties, and prepared to support an investigation and appropriate action to protect users. These statements describe issuer actions; they do not, on their own, confirm the full scope of the hack or identify the people behind the wallets.

The reported RLUSD movements show how quickly tokens may be converted. The attacker swapped 36 million RLUSD for 15,439 ETH, while 52.54 million RLUSD remained unfrozen at a holding wallet, according to an on-chain update circulating on X. Etherscan showed the main receiving wallet holding about $88.5 million in RLUSD at 20:41 UTC, a figure that matches the two amounts combined. The difference between frozen and unfrozen balances highlights why stablecoin issuers’ address controls have become a significant part of the response.

Other services appeared in the transaction trail, but their role was limited in the available account. Tornado Cash, a mixer that obscures the trail of crypto payments, appeared only as a funding source for the address that set up the attack. Its appearance in that context does not demonstrate that the later funds were routed through the mixer.

The incident also brings to mind the aftermath of the Bybit hack. According to Bybit’s CEO, North Korea’s Lazarus Group converted 84.45% of the stolen ETH to Bitcoin through Thorchain, a cross-chain swap network. Monero, a privacy coin designed to conceal who sent what, rose about 6% on Thursday, which was described as suggesting a possible rotation into the privacy coin. That movement is an indicator, not proof of a connection to the Binance-related activity.

Overall, the on-chain picture combines rapid conversions, borrowing against stablecoin collateral, issuer-led freezes, and large ETH balances that had not yet moved onward. The reported activity involves at least $5.5 billion in suspected losses, more than $2 billion in frozen USDT and USDC, and about 253,000 ETH—roughly $570 million—held in two wallets without outgoing transfers as of 22:07 UTC. These figures describe the information available at the stated times and may change as investigators and exchanges continue their work.

Key Insights Table

Afterwards...

The next steps will depend on the investigation, further on-chain movements, and coordination among Binance, stablecoin issuers, DeFi protocols, and relevant authorities. Wallet balances and transaction records can help analysts trace assets, while centralized stablecoin issuers may be able to restrict their own tokens at designated addresses. Ethereum remains different: no issuer can freeze ETH, so tracking and recovery efforts may require other methods.

Market pauses can reduce new exposure while teams assess potential risks, but they do not erase transactions that have already settled. As the situation develops, the most useful signals will be verified updates from the exchange and protocols, changes in wallet balances, and clear explanations of any confirmed impact on customers. Until those details are established, reported figures and labels should be treated as provisional rather than as a final accounting of responsibility or losses.