ethereum ·
Binance Hacker Hunts for Exit Ramps as DeFi Exchanges Pause Markets
Wallets connected to the suspected Binance security breach have been utilizing decentralized exchanges for exit strategies, exchanging stablecoins that issuers can freeze for Ethereum, which lacks an issuer capable of freezing it, based on Etherscan data for eight wallets designated as exploiters.
These wallets acquired tens of thousands of ETH from Uniswap contracts and borrowed 19,762 ETH on Aave, utilizing approximately $60 million worth of USDT, with no indication of flaws in either application.
As of 22:07 UTC, roughly $570 million, or about 253,000 ETH, remained in two wallets without any outgoing transfers, given that ETH possesses no issuer to halt its movement.
Stablecoin providers Tether and Circle promptly blacklisted the suspected attacker's addresses to immobilize a portion of the funds; as centralized issuers, they possess the capability to blacklist tokens, and over $2 billion of these two tokens has been frozen by various providers.
Specific transactions showed one relay wallet receiving 20,940 ETH from Uniswap’s UniswapX contract at 20:34 UTC, alongside other significant inflows from Uniswap contracts to subsequent wallets.
Aave provided a secondary exit point; between 20:57 and 21:01 UTC, one wallet deposited $10 million and then $50 million in USDT, borrowing 3,271 ETH ($7.43 million) and subsequently 16,491 ETH ($37.47 million) against it, prompting cybersecurity experts Odysseas Lamtzidi, founder of Phylax Systems, to issue a warning of “contagion in full effect.”
In response, Aave has frozen its V3 markets on the Ethereum mainnet, halting new deposits and borrowing, while Kamino, a DeFi protocol on Solana, also paused its Solana and Bitcoin markets as a precaution, though Kamino confirmed it is currently unaffected by the Binance incident.
Ripple's co-CEO, Yi He, stated that Ripple has frozen approximately $200 million in RLUSD, in addition to the more than $2 billion in USDT and USDC that have been frozen. Jack McDonald, Ripple’s senior vice president for stablecoins, stated: “Ripple is closely monitoring reports of a potential exploit involving Binance and its attackers’ RLUSD holdings and we are actively freezing affected funds. We’re coordinating with relevant parties and stand ready to support any investigation and appropriate action to keep users protected.”
The utilization of decentralized exchanges and lending protocols highlights how protocol-level mechanisms are being exploited during periods of systemic stress within the DeFi ecosystem.
