Binance Hacker Hunts for Exit Ramps as DeFi Exchanges Pause Markets - Cryptonews.net
Wallets linked to the suspected Binance hack have received tens of thousands of ETH from Uniswap contracts and borrowed 19,762 ETH on Aave against about $60 million in USDT, with no sign of a flaw in either application.
Wallets tied to the suspected Binance hack have received tens of thousands of ETH from Uniswap contracts and borrowed 19,762 ETH on Aave against about $60 million in USDT, with no sign of a flaw in either application. As of 22:07 UTC, 253,000 ETH, roughly $570 million, sat in two wallets with no outgoing transfers, and ETH has no issuer that can freeze it.
DeFi Exchanges as Exit Strategy
The attacker is using decentralized exchanges such as Uniswap and Aave as exits, swapping stablecoins that issuers can freeze for Ethereum that nobody can, according to Etherscan records for 10 wallets, eight of them labeled as exploiters.
One relay wallet received 20,940 ETH ($45.58 million) from Uniswap's UniswapX contract at 20:34 UTC, another got 3,552 ETH (over $8 million) at 20:47 UTC, and two later wallets took in about 18,085 ETH (around $41 million) from Uniswap contracts.
Contagion in full effect
Stablecoin Freezes
Stablecoin issuers Tether and Circle moved quickly to blacklist the suspected attacker's addresses in order to freeze a portion of the funds and make them inaccessible. As centralized issuers, they each have the ability to blacklist addresses so their tokens cannot move, and more than $2 billion of those two tokens have been frozen so far by different stablecoin providers.
The attacker also swapped 36 million RLUSD, Ripple's dollar-backed stablecoin, for 15,439 ETH, while 52.54 million RLUSD remained unfrozen at the holding wallet. Ripple has since frozen about $200 million, according to Binance co-CEO Yi He.
Thanks to the Ripple team for promptly freezing approximately 200 million. User Funds are SAFU
DeFi Protocols Respond
Aave has frozen its V3 markets on Ethereum mainnet, which blocks new deposits and borrowing. Kamino, a decentralized finance protocol built on the Solana blockchain, also paused its Solana and Bitcoin markets as a precautionary measure.
The $570 million in ETH is piling up rather than moving on. A wallet labeled Exploiter 8 still held 195,460 ETH ($444.2 million) at 22:03 UTC, and another 57,891.77 ETH ($131.6 million) reached one labeled Exploiter 11, together about 253,000 ETH.
Tornado Cash, a mixer that scrambles the trail of crypto payments, appears so far only as funding for the address that set up the attack. After the Bybit hack, North Korea's Lazarus Group converted 84.45% of the stolen ETH to Bitcoin through Thorchain, suggesting similar tactics might be employed here.
Related
