conv.

All stories
SecurityQuiet 13d · day 13

Binance hack drains $5.5B as attacker races to convert stolen crypto to untraceable ETH

DeFi platforms and stablecoin issuers mobilize to freeze funds while the attacker moves assets through decentralized exchanges.

newest coverage 13d agosummary written 13d ago5 pieces2 likes & upvotes NewswiresMastodonHacker NewsGoogle News

What to know

  • Binance suffered a breach draining at least $5.5 billion, potentially the largest hack in crypto history, with the total still climbing.
  • The attacker has moved stolen funds through decentralized exchanges (Uniswap, Aave) to convert frozen stablecoins into Ethereum, which has no centralized issuer to freeze.
  • Stablecoin issuers including Tether, Circle, and Ripple have frozen over $2 billion in attacker-controlled tokens; approximately $570 million in Ethereum remains in identified wallets with no clear exit route.
  • Multiple DeFi protocols (Aave, Kamino) paused markets as a precaution, though Binance has not confirmed whether user deposits were affected.

“Kamino can confirm that it is currently unaffected by the ongoing Binance situation. Out of an abundance of caution, we have temporarily paused borrowing in the SOL/BTC Market”

Kamino, DeFi protocol · Decrypt ↗

Binance Hacked exchangeTether Stablecoin issuerCircle Stablecoin issuerRipple Stablecoin issuerYi He Binance co-CEOOdysseas Lamtzidi Cybersecurity expert, Phylax Systems founder

Binance hack drains $5.5B as attacker races to convert stolen crypto to untraceable ETH
decrypt.co

How it unfolded 1 development · click the chart to see its coverage articlesposts

Peak 4 pieces in 3h at Oct 29, 6 PM; 5 pieces over 13 days (3 articles · 2 posts) Oct 29, 6 PM — 4 pieces · 3 articles · 1 post — Newswires 2, Google News 1, Mastodon 1Oct 29, 9 PM — 1 piece · 1 post — Hacker News 1Oct 30, 12 AM — quietOct 30, 3 AM — quietOct 30, 6 AM — quietOct 30, 9 AM — quietOct 30, 12 PM — quietOct 30, 3 PM — quietOct 30, 6 PM — quietOct 30, 9 PM — quietOct 31, 12 AM — quietOct 31, 3 AM — quietOct 31, 6 AM — quietOct 31, 9 AM — quietOct 31, 12 PM — quietOct 31, 3 PM — quietOct 31, 6 PM — quietOct 31, 9 PM — quietNov 1, 12 AM — quietNov 1, 2 AM — quietNov 1, 5 AM — quietNov 1, 8 AM — quietNov 1, 11 AM — quietNov 1, 2 PM — quietNov 1, 5 PM — quietNov 1, 8 PM — quietNov 1, 11 PM — quietNov 2, 2 AM — quietNov 2, 5 AM — quietNov 2, 8 AM — quietNov 2, 11 AM — quietNov 2, 2 PM — quietNov 2, 5 PM — quietNov 2, 8 PM — quietNov 2, 11 PM — quietNov 3, 2 AM — quietNov 3, 5 AM — quietNov 3, 8 AM — quietNov 3, 11 AM — quietNov 3, 2 PM — quietNov 3, 5 PM — quietNov 3, 8 PM — quietNov 3, 11 PM — quietNov 4, 2 AM — quietNov 4, 5 AM — quietNov 4, 8 AM — quietNov 4, 11 AM — quietNov 4, 2 PM — quietNov 4, 5 PM — quietNov 4, 8 PM — quietNov 4, 11 PM — quietNov 5, 2 AM — quietNov 5, 5 AM — quietNov 5, 8 AM — quietNov 5, 11 AM — quietNov 5, 2 PM — quietNov 5, 5 PM — quietNov 5, 8 PM — quietNov 5, 11 PM — quietNov 6, 2 AM — quietNov 6, 5 AM — quietNov 6, 8 AM — quietNov 6, 11 AM — quietNov 6, 2 PM — quietNov 6, 5 PM — quietNov 6, 8 PM — quietNov 6, 11 PM — quietNov 7, 2 AM — quietNov 7, 5 AM — quietNov 7, 8 AM — quietNov 7, 11 AM — quietNov 7, 2 PM — quietNov 7, 5 PM — quietNov 7, 8 PM — quietNov 7, 11 PM — quietNov 8, 2 AM — quietNov 8, 5 AM — quietNov 8, 8 AM — quietNov 8, 11 AM — quietNov 8, 2 PM — quietNov 8, 5 PM — quietNov 8, 8 PM — quietNov 8, 11 PM — quietNov 9, 2 AM — quietNov 9, 5 AM — quietNov 9, 8 AM — quietNov 9, 11 AM — quietNov 9, 2 PM — quietNov 9, 5 PM — quietNov 9, 8 PM — quietNov 9, 11 PM — quietYesterday, 2 AM — quietYesterday, 5 AM — quietYesterday, 8 AM — quietYesterday, 11 AM — quietYesterday, 2 PM — quietYesterday, 5 PM — quietYesterday, 8 PM — quietYesterday, 11 PM — quietToday, 2 AM — quietToday, 5 AM — quietToday, 8 AM — quietToday, 11 AM — quietToday, 2 PM — quietToday, 5 PM — quietToday, 8 PM — quiet ◂ 1 earlier
Oct 30Oct 31Nov 1Nov 2Nov 3Nov 4Nov 5Nov 6Nov 7Nov 8Nov 9yesterdaynow · 9:14 PM ET
  1. 1

    Approximately $570 million in ETH sits in two attacker wallets

    On-chain data showed two wallets labeled Exploiter 8 and Exploiter 11 holding approximately 253,000 ETH (roughly $570 million) combined. The ETH was accumulating rather than moving further, suggesting difficulty finding exit routes.

    “Thanks to the Ripple team for promptly freezing approximately 200 million. User Funds are SAFU…”
    — Yi He, Binance co-CEO · source
  2. background

    Kamino pauses Solana and Bitcoin markets as precaution — Kamino, a decentralized finance protocol on Solana, paused borrowing in its SOL/BTC market as a precautionary measure, stating it was currently unaffected but monitoring the situation.

  3. background

    Aave freezes V3 markets on Ethereum mainnet — Aave paused its V3 markets on Ethereum mainnet, blocking new deposits and borrowing in response to the attack.

  4. background

    Stablecoin issuers freeze attacker's tokens — Tether and Circle quickly blacklisted the suspected attacker's addresses, freezing over $2 billion in their stablecoins. Ripple froze approximately $200 million in RLUSD after the attacker swapped 36 million RLUSD for 15,439 ETH.

  5. background

    Attacker uses Aave lending protocol to borrow additional Ethereum — Between 20:57 and 21:01 UTC, the attacker deposited $60 million in USDT to Aave and borrowed 19,762 ETH ($44.9 million) against it. Cybersecurity expert Odysseas Lamtzidi warned of "contagion in full effect."

  6. background

    Attacker begins converting stablecoins to Ethereum through Uniswap — The attacker started using decentralized exchange Uniswap to swap stablecoins for Ethereum. One relay wallet received 20,940 ETH ($45.58 million) at 20:34 UTC, followed by additional batches totaling approximately $121 million in ETH over the next 13 minutes.

  7. background

    Binance wallets drained of at least $5.5 billion — Wallets linked to Binance were drained of at least $5.5 billion, with the total still climbing. Binance said it was investigating but did not confirm user funds were affected, though security experts believe the exchange was indeed hacked.

Also covered reported alongside — the timeline has no entry for these yet

  1. 2 outlets Binance Hacker Hunts for Exit Ramps as DeFi Exchanges Pause Markets

    first by Decrypt, 13d ago · also Yahoo Finance