Binance Hacker Hunts for Exit Ramps as DeFi Exchanges Pause Markets

What it is

Decrypt's on-chain account of how wallets linked to the suspected Binance theft (at least $5.5 billion, 29 October 2026) moved funds in the first hours. It is based on Etherscan records for 10 wallets, eight labeled as exploiters. Binance said it was investigating but did not confirm that user funds were affected. Decrypt says security experts widely believe the exchange was hacked.

How it works

The pattern is to convert stablecoins that issuers can freeze into ETH, which has no issuer and cannot be frozen.

• Uniswap: A relay wallet received 20,940 ETH ($45.58 million) from the UniswapX contract at 20:34 UTC, and another received 3,552 ETH at 20:47. Two later wallets took about 18,085 ETH (batches of 7,444 and 10,642) and about 16,498 ETH (batches of 6,946 and 9,552).
• Aave: Between 20:57 and 21:01 UTC, one wallet deposited $10 million and then $50 million in USDT. It borrowed 3,271 ETH and then 16,491 ETH, 19,762 ETH in total.
• RLUSD: The attacker swapped 36 million RLUSD for 15,439 ETH. About 52.54 million RLUSD was still unfrozen at the holding wallet, which held about $88.5 million in RLUSD at 20:41 UTC.
• Consolidation: About 253,000 ETH (roughly $570 million) sat in two wallets. Exploiter 8 held 195,460 ETH at 22:03 UTC. Exploiter 11 received 57,891.77 ETH through four hops in 28 minutes (Exploiter 4 to 5, 5 to 6, 6 to 7, 7 to 11). Neither wallet had outgoing transfers as of 22:07 UTC.

Preconditions / Affected

Decrypt reports no sign of a flaw in Uniswap or Aave. The attacker used them as designed. Any lending market that accepts freezable stablecoins as collateral and lends out ETH is exposed to the same pattern.

Responses reported:

• Tether and Circle blacklisted the suspected addresses. More than $2 billion in USDT and USDC was frozen across stablecoin providers.
• Ripple froze about $200 million in RLUSD, per Binance co-CEO Yi He.
• Aave froze its V3 markets on Ethereum mainnet, which blocks new deposits and borrowing.
• Kamino paused borrowing in its SOL/BTC market, saying it was unaffected.

Caveats

• Figures are as of about 22:07 UTC on 29 October, and the total loss was still rising.
• The RLUSD swap figures come from an on-chain update circulating on X, not from Decrypt's own analysis.
• Tornado Cash appears only as funding for the address that set up the attack. Decrypt reports no mixer use for the proceeds so far.
• Decrypt notes that after the Bybit hack, Lazarus Group converted 84.45% of the stolen ETH to Bitcoin through Thorchain, per Bybit's CEO. Monero rose about 6% on Thursday 29 October. Decrypt says this suggests a possible rotation into privacy coins. Neither point is tied to this attacker.
• The page does not explain how Binance was breached.