Binance Hacker Hunts for Exit Ramps as DeFi Exchanges Pause Markets

Decrypt10-29 22:57

In brief Wallets tied to the suspected Binance hack received tens of thousands of ETH from Uniswap contracts and borrowed 19,762 ETH on Aave against about $60 million in USDT, with no sign of a flaw ...

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Comments

We need your insight to fill this gap

Leave a comment

{"i18n":{"language":"en_US"},"isChannel":false,"data":{"share":"https://ttm.financial/m/news/2679258808?lang=en_US&edition=fundamental","thumbnail":"https://img.decrypt.co/insecure/rs:fit:3840:0:0:0/plain/https://cdn.decrypt.co/wp-content/uploads/2025/05/Hacker-decrypt-style-02-gID_7.png@webp","is_english":true,"pubTime":"2026-10-29 22:57","share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","id":"2679258808","market":"nz","top_or_hot":-1,"title":"Binance Hacker Hunts for Exit Ramps as DeFi Exchanges Pause Markets","media":"Decrypt","content":"<div>\n<p>In brief\nWallets tied to the suspected Binance hack received tens of thousands of ETH from Uniswap contracts and borrowed 19,762 ETH on Aave against about $60 million in USDT, with no sign of a flaw ...</p>\n\n<a href=\"https://decrypt.co//382194/binance-hack-exit-ramps-defi-exchange-ethereum\">Source Link</a>\n\n</div>\n","source":"decrypt_highlight","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>Binance Hacker Hunts for Exit Ramps as DeFi Exchanges Pause Markets</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nBinance Hacker Hunts for Exit Ramps as DeFi Exchanges Pause Markets\n</h2>\n\n<h4 class=\"meta\">\n\n\n2026-10-29 22:57 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://decrypt.co//382194/binance-hack-exit-ramps-defi-exchange-ethereum><strong>Decrypt</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>In brief\nWallets tied to the suspected Binance hack received tens of thousands of ETH from Uniswap contracts and borrowed 19,762 ETH on Aave against about $60 million in USDT, with no sign of a flaw ...</p>\n\n<a href=\"https://decrypt.co//382194/binance-hack-exit-ramps-defi-exchange-ethereum\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":"BTC","symbol_name":"Grayscale Bitcoin Mini Trust","start_time":0,"source_url":"https://decrypt.co//382194/binance-hack-exit-ramps-defi-exchange-ethereum","article_id":"2679258808","we_media_id":null,"thumbnails":["https://img.decrypt.co/insecure/rs:fit:3840:0:0:0/plain/https://cdn.decrypt.co/wp-content/uploads/2025/05/Hacker-decrypt-style-02-gID_7.png@webp"],"rights":{"source":"decrypt_highlight","url":"https://decrypt.co//382194/binance-hack-exit-ramps-defi-exchange-ethereum","rn_cache_url":null,"directOrigin":true},"url":"https://stock-news.laohu8.com/highlight/detail?id=2679258808","pubTimestamp":1793285868,"columns":[],"sourceInfo":{"source_id":"decrypt_highlight","name":"Decrypt"},"weMediaInfo":null,"summary":"The attacker behind the wallets draining Binance is using decentralized exchanges such as Uniswap and Aave as exits, swapping stablecoins that issuers can freeze for Ethereum that nobody can, according to Etherscan records for 10 wallets, eight of them labeled as exploiters.\nEarlier today, wallets linked to the world’s largest crypto exchange were drained of at least $5.5 billion, with the total tally still climbing. The company said it was investigating the security incident but did not confirm...","collect":0,"end_time":0,"defaultTopTitle":"decrypt.co","property":[],"viewcount":null,"language":"en","relate_stocks":{"BTC":"Grayscale Bitcoin Mini Trust","YBTC":"比特币看涨期权ETF-Roundhill","BITI":"1倍做空比特币期货ETF-Proshares","BAGY":"Amplify Bitcoin Max Income Covered Call ETF","ETCO":"Grayscale Ethereum HIGH Income ETF","BRRR":"比特币ETF-CoinShares","BFAP":"FT Vest Bitcoin Strategy Floor15 ETF - April","BTCC":"Grayscale Bitcoin HIGH Income ETF","BPI":"Grayscale Bitcoin Premium Income ETF","CBXY":"Calamos Bitcoin 90 Series Structured Alt Protection ETF - July","CBOA":"Calamos Bitcoin Structured Alt Protection ETF - April","BTCI":"NEOS Bitcoin High Income ETF","BITC":"Bitwise Trendwise Bitcoin and Treasuries Rotation Strategy ETF","CBTA":"Calamos Bitcoin 80 Series Structured Alt Protection ETF – April","BCCC":"Global X Bitcoin Covered Call ETF","BITB":"比特币ETF-Bitwise","SBIT":"2倍做空比特币期货ETF-Proshares","ETHU":"2倍以太币期货ETF-Volatility Shares","BTF":"比特币&以太币期货ETF-CoinShares","BTCO":"比特币ETF-Invesco Galaxy","ETHV":"以太坊ETF-VanEck","MAXI":"比特币期货ETF-Simplify","BITX":"2倍比特币期货ETF-Volatility Shares","QETH":"以太坊ETF-Invesco Galaxy","ETH":"低成本以太坊ETF-Grayscale","CBOO":"Calamos Bitcoin Structured Alt Protection ETF - October","TETH":"21Shares Ethereum ETF","ETHW":"以太坊ETF-Bitwise","CBTO":"Calamos Bitcoin 80 Series Structured Alt Protection ETF - October","DFII":"FT Cboe Vest Bitcoin Strategy & Target Income ETF","ETQ":"T-Rex 2X Inverse Ether Daily Target ETF","BETE":"等权重比特币&以太币期货ETF-ProShares","DEFI":"比特币期货ETF-Hashdex","ETHA":"以太坊ETF-iShares","BFJL":"FT Vest Bitcoin Strategy Floor15 ETF - July","BTRN":"比特币期货ETF-Global X","BITU":"2倍做多比特币期货ETF-Proshares","YETH":"Roundhill Ether Covered Call Strategy ETF","EZET":"以太坊ETF-Franklin","FETH":"以太币ETF-Fidelity","CBXA":"Calamos Bitcoin 90 Series Structured Alt Protection ETF – April","EZBC":"比特币ETF-Franklin","ETHD":"ProShares UltraShort Ether ETF","BTCZ":"T-Rex 2X Inverse Bitcoin Daily Target ETF","CBXJ":"Calamos Bitcoin 90 Series Structured Alt Protection ETF - January","ETHE":"最大以太坊ETF-Grayscale"},"translate_title":"随着 DeFi 交易所暂停市场，币安黑客寻找退出坡道","themeId":null,"isJumpTheme":false,"ttsUrl":null,"symbols_score_info":{"BITB":0.6,"QETH":0.6,"BTCC":0.6,"BTF":0.6,"BFAP":0.6,"CBXY":0.6,"BITI":0.6,"DEFI":0.6,"ETHU":0.6,"BTRN":0.6,"BETE":0.6,"BITC":0.6,"BPI":0.6,"BTCZ":0.6,"CBTA":0.6,"BFJL":0.6,"BAGY":0.6,"ETQ":0.6,"SBIT":0.6,"BTCO":0.6,"ETHV":0.6,"FETH":0.6,"BTC":0.6,"EZBC":0.6,"CBXA":0.6,"ETHD":0.6,"BTCI":0.6,"MAXI":0.6,"BITU":0.6,"TETH":0.6,"YBTC":0.6,"ETH":0.6,"CBOO":0.6,"ETCO":0.6,"ETHW":0.6,"CBOA":0.6,"ETHA":0.6,"BITX":0.6,"CBXJ":0.6,"ETHE":0.6,"EZET":0.6,"BCCC":0.6,"YETH":0.6,"BRRR":0.6,"DFII":0.6,"CBTO":0.6},"content_text":"In brief\nWallets tied to the suspected Binance hack received tens of thousands of ETH from Uniswap contracts and borrowed 19,762 ETH on Aave against about $60 million in USDT, with no sign of a flaw in either app.\nAbout 253,000 ETH, roughly $570 million, sat in two wallets with no outgoing transfers as of 22:07 UTC, and ETH has no issuer that can freeze it.\nRipple has frozen about $200 million in RLUSD, per Binance co-CEO Yi He, on top of the more than $2 billion in USDT and USDC.\nThe attacker behind the wallets draining Binance is using decentralized exchanges such as Uniswap and Aave as exits, swapping stablecoins that issuers can freeze for Ethereum that nobody can, according to Etherscan records for 10 wallets, eight of them labeled as exploiters.Earlier today, wallets linked to the world’s largest crypto exchange were drained of at least $5.5 billion, with the total tally still climbing. The company said it was investigating the security incident but did not confirm user funds were affected, though security experts widely believe the exchange was indeed hacked.Myriad: How low will Bitcoin go? Click to make your prediction.Stablecoin issuers Tether and Circle moved quickly to blacklist the suspected attacker’s addresses in order to freeze a portion of the funds and make them inaccessible. As centralized issuers, they each have the ability to blacklist addresses so their tokens cannot move, and more than $2 billion of those two tokens have been frozen so far by different stablecoin providers. ETH has no issuer, so every dollar converted before a freeze lands is out of their reach.The swaps run through Uniswap, a decentralized exchange where trades settle automatically with no company in the middle.BitcoinBTC · USD$79,015−2.97%24H7D1M1YYTDOct 23Oct 24Oct 26Oct 28Oct 29$82.0k$81.0k$79.9k$78.9k24h HighHigh$81,84024h LowLow$78,475VolVol$1.8B→Buy Bitcoin with USDTPowered by Jupiter$50$100$500BuyPrice data by CoinGeckoCoinGeckoMore Bitcoin news and projections →One relay wallet received 20,940 ETH ($45.58 Million) from Uniswap’s UniswapX contract at 20:34 UTC, another got 3,552 ETH (over $8 million) at 20:47, and two later wallets took in about 18,085 ETH (around $41 million) from Uniswap contracts, in 7,444 ETH and 10,642 ETH batches, and about 16,498 ETH ($37.5 million), in 6,946 ETH and 9,552 ETH batches.Aave, a lending app where users deposit crypto as collateral to borrow other coins, offered a second exit. Between 20:57 and 21:01 UTC, one wallet deposited $10 million and then $50 million in USDT and borrowed 3,271 ETH ($7.43 million) and then 16,491 ETH ($37.47 million) against it, which prompted cybersecurity experts Odysseas Lamtzidi, founder of Phylax Systems, to warn of “contagion in full effect.”\nUpdate: https://t.co/G3Z72cuDXM\nThey just approved AAVE. \nContagion in full effect https://t.co/aNz2snt8E6\n— Odysseus | phylax.systems (@odysseas_eth) October 29, 2026Aave has since frozen its V3 markets on Ethereum mainnet, which blocks new deposits and borrowing.Kamino, a decentralized finance protocol built on the Solana blockchain, also paused its Solana and Bitcoin markets as a precautionary measure.\nKamino can confirm that it is currently unaffected by the ongoing Binance situation\nOut of an abundance of caution, we have temporarily paused borrowing in the SOL/BTC Market\nWe are actively monitoring the situation and are in communication with various partners. Any further…\n— Kamino (@kamino) October 29, 2026The ETH is piling up rather than moving on. A wallet labeled Exploiter 8 still held 195,460 ETH ($444.2 million) at 22:03 UTC, and another 57,891.77 ETH ($131.6 million) reached one labeled Exploiter 11, together about 253,000 ETH, or roughly $570 million. That second pile arrived after four hops in 28 minutes, from Exploiter 4 to 5, 5 to 6, 6 to 7 and 7 to 11.The attacker also swapped 36 million RLUSD, Ripple’s dollar-backed stablecoin, for 15,439 ETH, while 52.54 million RLUSD remained unfrozen at the holding wallet, according to an on-chain update circulating on X. Etherscan showed the main receiving wallet holding about $88.5 million in RLUSD at 20:41 UTC, which matches the two figures combined.Image: Odysseas Lamtzidi via XRipple has since frozen about $200 million, according to Binance co-CEO Yi He. “Thanks to the Ripple team for promptly freezing approximately 200 million. User Funds are SAFU,” a reference to the exchange’s emergency reserve fund, Yi He wrote on X.“Ripple is closely monitoring reports of a potential exploit involving Binance and its attackers’ RLUSD holdings and we are actively freezing affected funds,” Jack McDonald, Ripple’s senior vice president for stablecoins, said in a statement. “We’re coordinating with relevant parties and stand ready to support any investigation and appropriate action to keep users protected.”\nRipple is closely monitoring reports of a potential exploit involving Binance and its attackers’ RLUSD holdings and we are actively freezing affected funds. We’re coordinating with relevant parties and stand ready to support any investigation and appropriate action to keep users…\n— Jack McDonald (@_JackMcDonald_) October 29, 2026Tornado Cash, a mixer that scrambles the trail of crypto payments, appears so far only as funding for the address that set up the attack.After the Bybit hack, North Korea’s Lazarus Group converted 84.45% of the stolen ETH to Bitcoin through Thorchain, a cross-chain swap network, per Bybit’s CEO. Monero, a privacy coin that hides who sent what, rose about 6% on Thursday, suggesting a possible rotation into the privacy coin.Daily Debrief NewsletterStart every day with the top news stories right now, plus original features, a podcast, videos and more. Email addressJoin freeJoin 72,000+ readersCreate an account to save your articles.Add on GoogleAdd Decrypt as your preferred source to see more of our stories on Google.","kind":"highlight","is_publish_news":true,"is_publish_highlight":false,"is_publish_live":false,"is_publish_wemedia":false,"editions":null,"column":"","sentiment":"0","news_tag":"","news_rank":0,"isVideo":false,"video":null,"symbols":[],"gpt_button":0,"need_auth":false,"need_login_tip":false,"code":"91000000","status":"200"},"commentList":[],"isCommentEnd":true,"newsSizeData":{"likeSize":0,"commentSize":0,"repostSize":0,"favoriteSize":0,"likeStatus":false,"favoriteStatus":false},"APP":{"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","isDev":false,"isTTM":true,"isLaohu8Offline":false,"tenantId":"TBGLOBAL","deviceId":"web-server-community-laohu8-v3","version":"4.52.0","shortVersion":"4.52.0","platform":"web","vendor":"web","appName":"ttm","isIOS":false,"isAndroid":false,"isTiger":false,"isTHS":false,"isWeiXin":false,"isWeiXinMini":false,"isWeiBo":false,"isQQ":false,"isBaiduSwan":false,"isBaiduBox":false,"isDingTalk":false,"isToutiao":false,"isOnePlus":false,"isHuaWei":false,"isXiaomi":false,"isXiaomiWebView":false,"isOppo":false,"isVivo":false,"isSamsung":false,"isMobile":false},"href":"/m/news/2679258808","isCrawlerRequest":true}