Wallets tied to the Binance exploit are using decentralized protocols including Uniswap and Aave as exit routes, converting stablecoins that issuers can freeze into ETH, which has no issuer and cannot be frozen in the same way, according to Etherscan records cited in Decrypt. The report tracked 10 wallets, eight of them labeled as exploiters.
Earlier in the day, wallets linked to Binance, the world’s largest crypto exchange, were drained of at least $5.5 billion, with the total still climbing, the report said. Binance said it was investigating the security incident but did not confirm whether user funds were affected. Decrypt added that security experts broadly believe the exchange was hacked, and that the incident could become the largest hack in the crypto industry’s 18-year history.
Stablecoin issuers moved first, pushing flows toward ETH
Tether and Circle quickly blacklisted suspected attacker addresses to freeze part of the funds and make them inaccessible. As centralized issuers, both companies can block token transfers from specific addresses. Decrypt reported that more than $2 billion across those tokens had already been frozen by different stablecoin providers.
That left ETH as a cleaner escape route. Because Ethereum has no issuer, funds converted into ETH before a freeze lands are outside the reach of stablecoin issuers.
Uniswap handled a series of large swaps
The swaps were routed through Uniswap, a decentralized exchange where trades settle automatically on-chain without a company in the middle.
One relay wallet received 20,940 ETH, worth $45.58 million, from Uniswap’s UniswapX contract at 20:34 UTC. Another received 3,552 ETH, worth more than $8 million, at 20:47 UTC.
Two later wallets then took in about 18,085 ETH and about 16,498 ETH from Uniswap contracts. The first arrived in two batches of 7,444 ETH and 10,642 ETH, together worth around $41 million. The second came in two batches of 6,946 ETH and 9,552 ETH, together worth about $37.5 million.
Aave opened a second route out
Aave, the lending protocol where users deposit crypto as collateral to borrow other assets, also became part of the flow.
Between 20:57 and 21:01 UTC, one wallet deposited $10 million and then $50 million in USDT, then borrowed 3,271 ETH worth $7.43 million and 16,491 ETH worth $37.47 million against that collateral.
Odysseas Lamtzidi, founder of Phylax Systems, warned on X: 「They just approved AAVE. Contagion in full effect」.
Aave later froze its V3 markets on Ethereum mainnet, blocking new deposits and borrowing.
Kamino, a DeFi protocol built on Solana, also paused its Solana and Bitcoin markets as a precaution. In its X post, Kamino said it was currently unaffected by the Binance situation, but had temporarily paused borrowing in the SOL/BTC market out of caution while it monitored developments and stayed in contact with partners.
Large ETH balances accumulated in exploiter wallets
The ETH was piling up rather than moving on, according to the report. At 22:03 UTC, a wallet labeled Exploiter 8 still held 195,460 ETH worth $444.2 million. Another 57,891.77 ETH, worth $131.6 million, reached a wallet labeled Exploiter 11.
Together, those two wallets held about 253,000 ETH, or roughly $570 million. Decrypt said the second pile arrived after four hops in 28 minutes, moving from Exploiter 4 to 5, 5 to 6, 6 to 7, and 7 to 11.
RLUSD was also used, and Ripple froze part of the funds
An on-chain update circulating on X said the attacker swapped 36 million RLUSD, Ripple’s dollar-backed stablecoin, for 15,439 ETH, while 52.54 million RLUSD remained unfrozen in the holding wallet.
Etherscan showed the main receiving wallet holding about $88.5 million in RLUSD at 20:41 UTC, matching those two figures combined.
Binance co-CEO Yi He later said Ripple had frozen about $200 million. In an X post, she wrote: 「Thanks to the Ripple team for promptly freezing approximately 200 million. User Funds are SAFU」, referring to Binance’s emergency reserve fund.
Jack McDonald, Ripple’s senior vice president for stablecoins, said in a statement: 「Ripple is closely monitoring reports of a potential exploit involving Binance and its attackers’ RLUSD holdings and we are actively freezing affected funds. We’re coordinating with relevant parties and stand ready to support any investigation and appropriate action to keep users protected.」
Tornado Cash appeared only at the setup stage
Decrypt said Tornado Cash, the mixer used to obscure the trail of crypto payments, appeared so far only as a funding source for the address that set up the attack.
The report also referenced the Bybit hack and Monero
At the end of the article, Decrypt noted that after the Bybit hack, North Korea’s Lazarus Group converted 84.45% of the stolen ETH into Bitcoin through cross-chain swap network Thorchain, according to Bybit’s CEO.
The report also said Monero, the privacy coin designed to hide transaction participants and amounts, rose about 6% on Thursday, which it described as a possible sign of rotation into privacy coins.
