Don't want to trade it yourself?
Our desk runs DEX portfolios on profit share.
In brief
- Wallets tied to the suspected Binance hack received tens of thousands of ETH from Uniswap contracts and borrowed 19,762 ETH on Aave against about $60 million in USDT, with no sign of a flaw in either app.
- About 253,000 ETH, roughly $570 million, sat in two wallets with no outgoing transfers as of 22:07 UTC, and ETH has no issuer that can freeze it.
- Ripple has frozen about $200 million in RLUSD, per Binance co-CEO Yi He, on top of the more than $2 billion in USDT and USDC.
The attacker behind the wallets draining Binance is using decentralized exchanges such as Uniswap and Aave as exits, swapping stablecoins that issuers can freeze for Ethereum that nobody can, according to Etherscan records for 10 wallets, eight of them labeled as exploiters.
Earlier today, wallets linked to the world’s <a href="https://xpertsstudio.com/bitcoin-digital-assets-tumble-as-binance-reports-6-3-billion-breach-in-what-could-be-largest-crypto-hack-in-history/” title=”Bitcoin, digital assets tumble as Binance reports $6.3 billion breach in what could be largest crypto hack in history”>largest crypto exchange were drained of at least $5.5 billion, with the total tally still climbing. The company said it was investigating the security incident but did not confirm user funds were affected, though security experts widely believe the exchange was indeed hacked. It stands to be the largest hack in the crypto industry’s 18-year history.
Stablecoin issuers Tether and Circle moved quickly to blacklist the suspected attacker’s addresses in order to freeze a portion of the funds and make them inaccessible. As centralized issuers, they each have the ability to blacklist addresses so their tokens cannot move, and more than $2 billion of those two tokens have been frozen so far by different stablecoin providers. ETH has no issuer, so every dollar converted before a freeze lands is out of their reach.
The swaps run through Uniswap, a decentralized exchange where trades settle automatically with no company in the middle.
BitcoinBTC· USD
$77,777−4.79%
Oct 23Oct 25Oct 26Oct 28Oct 30
$82.0k$80.3k$78.6k$76.8k
24h HighHigh$81,840
24h LowLow$76,443
VolVol$2.7B
→Buy Bitcoin with USDT
Powered by Jupiter
Price data by CoinGeckoCoinGeckoMore Bitcoinnews and projections →
One relay wallet received20,940 ETH ($45.58 Million) from Uniswap’s UniswapX contract at 20:34 UTC, another got 3,552 ETH (over $8 million) at 20:47, and two later wallets took in about 18,085 ETH (around $41 million) from Uniswap contracts, in 7,444 ETH and 10,642 ETH batches, and about 16,498 ETH ($37.5 million), in 6,946 ETH and 9,552 ETH batches.
Aave, a lending app where users deposit crypto as collateral to borrow other coins, offered a second exit. Between 20:57 and 21:01 UTC, one wallet deposited $10 million and then $50 million in USDT and borrowed 3,271 ETH ($7.43 million) and then 16,491 ETH ($37.47 million) against it, which prompted cybersecurity experts Odysseas Lamtzidi, founder of Phylax Systems, to warn of “contagion in full effect.”
https://x.com/odysseas_eth/status/2115912235981914215
Aave has since frozen its V3 markets on Ethereum mainnet, which blocks new deposits and borrowing.
Kamino, a decentralized finance protocol built on the Solana blockchain, also paused its Solana and Bitcoin markets as a precautionary measure.
https://x.com/kamino/status/2115927540212650346
The ETH is piling up rather than moving on. A wallet labeled Exploiter 8 still held 195,460 ETH ($444.2 million) at 22:03 UTC, and another 57,891.77 ETH ($131.6 million) reached one labeled Exploiter 11, together about 253,000 ETH, or roughly $570 million. That second pile arrived after four hops in 28 minutes, from Exploiter 4 to 5,5 to 6,6 to 7 and7 to 11.
The attacker also swapped 36 million RLUSD, Ripple’s dollar-backed stablecoin, for 15,439 ETH, while 52.54 million RLUSD remained unfrozen at the holding wallet, according to an on-chain update circulating on X. Etherscan showed the main receiving wallet holding about $88.5 million in RLUSD at 20:41 UTC, which matches the two figures combined.
Ripple has since frozen about $200 million, according to Binance co-CEO Yi He. “Thanks to the Ripple team for promptly freezing approximately 200 million. User Funds are SAFU,” a reference to the exchange’s emergency reserve fund, Yi He wrote on X.
“Ripple is closely monitoring reports of a potential exploit involving Binance and its attackers’ RLUSD holdings and we are actively freezing affected funds,” Jack McDonald, Ripple’s senior vice president for stablecoins, said in a statement. “We’re coordinating with relevant parties and stand ready to support any investigation and appropriate action to keep users protected.”
https://x.com/_JackMcDonald_/status/2115928859854221744
Tornado Cash, a mixer that scrambles the trail of crypto payments, appears so far only as funding for the address that set up the attack.
After the Bybit hack, North Korea’s Lazarus Group converted 84.45% of the stolen ETH to Bitcoin through Thorchain, a cross-chain swap network, per Bybit’s CEO. Monero, a privacy coin that hides who sent what, rose about 6% on Thursday, suggesting a possible rotation into the privacy coin.
Daily Debrief Newsletter
Start every day with the top news stories right now, plus original features, a podcast, videos and more.
Create an accountto save your articles.
Add on GoogleAdd Decrypt as your preferred
Source: decrypt.co