Binance Hacker Hunts for Exit Ramps as DeFi Exchanges Pause Markets

In brief

• Wallets tied to the suspected Binance hack received tens of thousands of ETH from Uniswap contracts and borrowed 19,762 ETH on Aave against about $60 million in USDT, with no sign of a flaw in either app.
• About 253,000 ETH, roughly $570 million, sat in two wallets with no outgoing transfers as of 22:07 UTC, and ETH has no issuer that can freeze it.
• Ripple has frozen about $200 million in RLUSD, per Binance co-CEO Yi He, on top of the more than $2 billion in USDT and USDC.

The attacker behind the wallets draining Binance is using decentralized exchanges such as Uniswap and Aave as exits, swapping stablecoins that issuers can freeze for Ethereum that nobody can, according to Etherscan records for 10 wallets, eight of them labeled as exploiters.

Earlier today, wallets linked to the world’s largest crypto exchange were drained of at least $5.5 billion, with the total tally still climbing. The company said it was investigating the security incident but did not confirm user funds were affected, though security experts widely believe the exchange was indeed hacked. It stands to be the largest hack in the crypto industry's 18-year history.

Stablecoin issuers Tether and Circle moved quickly to blacklist the suspected attacker’s addresses in order to freeze a portion of the funds and make them inaccessible. As centralized issuers, they each have the ability to blacklist addresses so their tokens cannot move, and more than $2 billion of those two tokens have been frozen so far by different stablecoin providers. ETH has no issuer, so every dollar converted before a freeze lands is out of their reach.