Binance Hacker Funnels Billions Through Uniswap and Aave to Evade Freezes

In what is rapidly shaping up to be the largest security breach in the 18-year history of the cryptocurrency industry, the attacker responsible for draining a staggering $5.5 billion from wallets linked to Binance is actively utilizing decentralized finance (DeFi) protocols to launder and secure their illicit gains. On-chain analysis of multiple Ethereum addresses reveals that the perpetrator is systematically converting centralized stablecoins—which issuers possess the authority to freeze—into decentralized assets like Ethereum, completely bypassing administrative blacklists.

Earlier today, major security alarms were triggered across the global digital asset ecosystem when wallets associated with the world’s largest cryptocurrency exchange were abruptly drained of at least $5.5 billion, with the cumulative total continuing to rise as monitoring systems scan the blockchain. While Binance leadership has initiated a comprehensive internal investigation into the unprecedented security incident, initial communications from the exchange stopped short of explicitly confirming whether user balances had been compromised. Nevertheless, prominent cybersecurity experts and blockchain intelligence firms have widely concluded that the platform suffered a catastrophic breach.

Reacting swiftly to contain the fallout, major centralized stablecoin issuers mobilized within minutes of the attack’s discovery. Both Tether and Circle moved aggressively to blacklist the suspected hacker’s receiving addresses, utilizing their administrative powers to freeze substantial blocks of capital and render the tokens immobile. According to preliminary on-chain tallies, more than $2 billion worth of Tether and USD Coin has been successfully frozen across various provider-controlled addresses.

However, because Ethereum operates on a decentralized architecture without a central issuing authority, any tokens converted into the native asset prior to a blacklist execution instantly slip beyond the reach of corporate intervention. This structural reality has turned decentralized exchange infrastructure into the primary tactical exit route for the hacker.

The tactical deployment of decentralized exchanges is clearly visible on-chain. The perpetrator has heavily relied on Uniswap, a leading decentralized exchange where trades are executed automatically via smart contracts without requiring an intermediary company or manual approval process. On-chain records from Etherscan highlight a sequence of massive fund movements passing through automated liquidity routes.

At 20:34 UTC, a primary relay wallet received 20,940 Ethereum, valued at approximately $45.58 million, originating from Uniswap’s advanced UniswapX settlement contract. Shortly after, at 20:47 UTC, a secondary wallet absorbed another 3,552 Ethereum, worth over $8 million. Subsequent transaction batches across later addresses pulled in thousands of additional tokens in rapid succession, including one set of transactions yielding roughly 18,085 Ethereum split into separate batches of 7,444 and 10,642 tokens, followed by another influx of roughly 16,498 Ethereum valued at $37.5 million, partitioned into chunks of 6,946 and 9,552 tokens.

Beyond automated token swaps on Uniswap, the attacker identified and exploited secondary avenues within decentralized lending markets. Aave, a prominent algorithmic money market where participants can deposit digital assets as collateral to borrow alternative cryptocurrencies, served as a crucial secondary exit channel. Between 20:57 and 21:01 UTC, an attacker-controlled address deposited an initial $10 million followed by a staggering $50 million in Tether into the protocol. Against this massive collateral pool, the wallet immediately borrowed 3,271 Ethereum, worth roughly $7.43 million, and a subsequent 16,491 Ethereum, valued at approximately $37.47 million.

This aggressive borrowing activity prompted immediate alarm bells throughout the developer and security community. Odysseas Lamtzidi, founder of Phylax Systems, publicly warned that the maneuver represented contagion in full effect across interconnected lending pools. Recognizing the systemic risk, the Aave core development and governance ecosystem acted decisively, freezing its V3 liquidity markets deployed on the Ethereum mainnet to effectively block any further deposits or debt issuance.

The defensive shockwaves extended beyond the Ethereum ecosystem. Kamino, a prominent decentralized finance protocol operating on the Solana blockchain, announced it was proactively pausing its local Solana and Bitcoin markets as a strict precautionary measure. In an official statement shared via social media, Kamino confirmed that while its infrastructure remained entirely unaffected by the ongoing Binance crisis, management chose to temporarily suspend borrowing within specific markets to mitigate potential contagion risks while monitoring the situation in coordination with industry partners.

Rather than dispersing immediately, the accumulated Ethereum is actively pooling into specialized holding wallets, indicating a calculated consolidation strategy. Blockchain data shows that an address labeled by analysts as Exploiter 8 held a massive balance of 195,460 Ethereum, worth roughly $444.2 million, late in the evening. Meanwhile, another designated address, Exploiter 11, amassed 57,891 Ethereum valued at approximately $131.6 million. Combined, these two major clusters account for roughly 253,000 Ethereum, translating to approximately $570 million parked in singular holding structures. The capital inside the second major cluster arrived following a rapid sequence of four distinct transaction hops executed within a narrow 28-minute window, routing funds sequentially through addresses labeled as Exploiter 4, 5, 6, 7, and finally landing in Exploiter 11.

Complicating the on-chain footprint further, the hacker also targeted alternative digital assets. On-chain tracking updates circulating across social media platforms revealed that the perpetrator swapped 36 million units of RLUSD, the dollar-backed stablecoin issued by Ripple, for 15,439 Ethereum. At the time of the swap, approximately 52.54 million additional RLUSD tokens remained unfrozen within the primary holding wallet. Etherscan records confirmed that the main receiving address held roughly $88.5 million in RLUSD at 20:41 UTC, directly aligning with the combined totals of the converted and stagnant balances.

As the situation evolved, Ripple took swift administrative action. Binance co-founder and co-CEO Yi He took to social media to acknowledge the rapid intervention by the financial technology firm. Thanks to the Ripple team for promptly freezing approximately 200 million units, Yi He wrote on X, offering reassurance by adding that user funds remain fully backed by the exchange’s emergency reserve fund, commonly known as SAFU.

Jack McDonald, Ripple’s senior vice president for stablecoins, corroborated the coordinated defense in a public statement. Ripple is closely monitoring reports of a potential exploit involving Binance and its attackers’ RLUSD holdings, and we are actively freezing affected funds, McDonald stated. We’re coordinating with relevant parties and stand ready to support any investigation and appropriate action to keep users protected.

While the attacker has actively exploited automated market makers, lending protocols, and stablecoin bridges, privacy-enhancing tools have also surfaced in the broader operational timeline. Tornado Cash, a well-known decentralized cryptocurrency mixer designed to obfuscate transaction trails, appeared in blockchain records primarily as the initial funding source utilized to bootstrap the addresses that ultimately executed the massive exploit.

Security analysts and market observers continue to draw parallels to previous high-profile industry heists. Following the major security breach that impacted Bybit, intelligence reports indicated that the Lazarus Group, a state-sponsored hacking syndicate linked to North Korea, successfully converted more than 84% of their stolen Ethereum into Bitcoin via Thorchain, a decentralized cross-chain liquidity network. Amidst the ongoing market turbulence and asset rotation following the Binance breach, privacy-focused assets like Monero experienced notable upward price movement, stoking speculation regarding potential broader market rotations into privacy-centric vehicles.