Wallets linked to the suspected Binance hack are converting freezeable stablecoins into Ethereum and using decentralized-finance platforms to move or borrow ETH, according to on-chain records reported by Decrypt. The activity has prompted Aave and Kamino to pause parts of their markets while stablecoin issuers work to block access to stolen funds.
Suspected attacker turns to Ethereum
At least $5.5 billion was drained from wallets linked to Binance on October 29, with the amount still increasing at the time of the report. Binance said it was investigating a security incident and did not confirm that customer funds had been affected. Security experts, however, widely regarded the event as a hack, which would make it the largest incident of its kind in the crypto industry’s 18-year history.
The suspected attacker has been using decentralized exchanges and lending protocols as routes for moving assets. Records on Etherscan covering 10 wallets—eight labeled as exploiters—show stablecoins being exchanged for ETH. Unlike USDT, USDC and RLUSD, ETH does not have a central issuer that can blacklist an address or freeze the token.
That distinction has shaped the response. Tether and Circle quickly blacklisted addresses associated with the suspected attacker, while more than $2 billion in USDT and USDC has been frozen by stablecoin providers, according to the report. Ripple also froze about $200 million in RLUSD, Binance co-CEO Yi He said.
Uniswap swaps and an Aave loan
Uniswap’s automated, decentralized trading system was used for several large ETH transfers. One relay wallet received 20,940 ETH, valued at $45.58 million, from the UniswapX contract at 20:34 UTC. Another received 3,552 ETH, worth more than $8 million, 13 minutes later.
Two further wallets later received approximately 18,085 ETH in batches of 7,444 ETH and 10,642 ETH, followed by about 16,498 ETH in batches of 6,946 ETH and 9,552 ETH. The movements indicate that the wallets were exchanging assets through smart-contract-based markets rather than relying on a conventional centralized exchange.
Aave provided a different mechanism. The lending protocol allows users to deposit one cryptoasset as collateral and borrow another. Between 20:57 and 21:01 UTC, one wallet deposited $10 million and then $50 million in USDT. Against that collateral, it borrowed 3,271 ETH, valued at $7.43 million, followed by 16,491 ETH worth $37.47 million.
The transactions led cybersecurity expert Odysseas Lamtzidi, founder of Phylax Systems, to warn on social media that “contagion” was fully underway. Aave subsequently froze its V3 markets on Ethereum’s mainnet, preventing new deposits and borrowing.
Kamino, a decentralized-finance protocol on Solana, also paused its Solana and Bitcoin markets as a precaution. The protocol said it was unaffected by the Binance situation, but temporarily halted borrowing in its SOL/BTC market while monitoring developments and communicating with partners.
Hundreds of thousands of ETH remain parked
Despite the conversion activity, large amounts of ETH were not immediately moved onward. As of 22:07 UTC, about 253,000 ETH—roughly $570 million—was held in two wallets without outgoing transfers.
One wallet labeled “Exploiter 8” held 195,460 ETH, valued at $444.2 million, at 22:03 UTC. Another 57,891.77 ETH, worth $131.6 million, had reached a wallet labeled “Exploiter 11.” That second balance arrived through four transfers in 28 minutes, moving from Exploiter 4 to 5, then 6, 7 and finally 11.
The attacker also exchanged 36 million RLUSD for 15,439 ETH. A further 52.54 million RLUSD remained unfrozen in the holding wallet, according to an on-chain update. Etherscan showed the main receiving wallet holding about $88.5 million in RLUSD at 20:41 UTC, consistent with the two amounts combined.
Ripple said it was actively freezing affected RLUSD and coordinating with relevant parties. Yi He thanked the company for freezing approximately $200 million and referred to Binance’s emergency reserve fund, known as SAFU. Tornado Cash appeared in the reported activity only as a funding source for the address that set up the attack, rather than as a confirmed route for laundering the stolen funds.
Moneyiar market picture
Moneyiar market data at 22:39 on October 25, 2026, showed Ethereum at $2,342.0570017305, up 0.02% over 24 hours but down 1.77% over seven days. BNB was $740.8618136891, up 0.81% in 24 hours and 3.32% over seven days.
Uniswap’s UNI token stood at $6.9787690874, gaining 2.51% over 24 hours while falling 2.12% over seven days. Shiba Inu was priced at $0.0000048638, down 0.75% over 24 hours and 1.21% over seven days. These figures precede the reported October 29 incident and are provided as Moneyiar market data at the stated time.
