Suspected Binance Hack Moves $570M From Frozen Stablecoins Into ETH

By Tom Whitfield

At least $5.5 billion was reported drained from Binance-linked wallets as stablecoin issuers froze more than $2 billion and Aave halted deposits and borrowing in its Ethereum V3 markets. Etherscan records for 10 wallets, eight labeled as exploiters, tied the outflow to Uniswap and Aave on October 29, 2026. The reported loss was still climbing.

Binance said it was investigating the security incident and did not confirm user funds were affected. Security experts widely believed the exchange had been hacked. The reported loss could stand as the largest hack in the crypto industry's 18-year history.

How did the funds leave issuer-controlled stablecoins?

Tether and Circle blacklisted the suspected attacker's addresses, seeking to freeze part of the proceeds. More than $2 billion in USDT and USDC has been frozen by different stablecoin providers. Their centralized issuer systems can block an address from moving a token, while ETH has no issuer with that power.

The wallets used Uniswap as the first conversion point. Its decentralized exchange settles trades automatically without a company operating between the buyer and seller. Etherscan showed these transfers from Uniswap contracts:

• One relay wallet received 20,940 ETH, worth $45.58 million, from the UniswapX contract at 20:34 UTC.
• A second wallet received 3,552 ETH, worth more than $8 million, at 20:47 UTC.
• Two later wallets received about 18,085 ETH, or roughly $41 million, in batches of 7,444 ETH and 10,642 ETH.
• Another transfer delivered about 16,498 ETH, worth $37.5 million, in batches of 6,946 ETH and 9,552 ETH.

No sign of a flaw appeared in either application. Uniswap processed the swaps and Aave processed the collateralized loans that converted stablecoins into an asset issuers cannot freeze.

What did Aave and Kamino freeze?

Aave offered the second exit. Between 20:57 and 21:01 UTC, one wallet deposited $10 million and then $50 million in USDT. Against roughly $60 million of collateral, it borrowed 3,271 ETH, valued at $7.43 million, followed by 16,491 ETH, valued at $37.47 million—19,762 ETH in total.

Phylax Systems founder Odysseas Lamtzidi warned that contagion was in full effect after Aave approved the borrows. Aave then froze its V3 markets on Ethereum mainnet, blocking new deposits and borrowing.

Kamino, a decentralized finance protocol built on Solana, temporarily paused its Solana and Bitcoin markets as a precaution. Kamino said it was unaffected by the Binance incident, was monitoring the situation and remained in communication with partners. The pause specifically stopped borrowing in its SOL/BTC market, while the announcement gave no restart date.

Where did the ETH go?

At 22:03 UTC, a wallet labeled Exploiter 8 held 195,460 ETH, worth $444.2 million. Another 57,891.77 ETH, worth $131.6 million, reached a wallet labeled Exploiter 11. The second transfer followed four hops in 28 minutes: Exploiter 4 to 5, 5 to 6, 6 to 7, and 7 to 11.

Together, the two wallets held about 253,000 ETH, or roughly $570 million, with no outgoing transfers as of 22:07 UTC. ETH lacks a centralized issuer, so the stablecoin freezes cannot reach assets already converted into it.

How much RLUSD moved, and how much was frozen?

The suspected attacker swapped 36 million RLUSD for 15,439 ETH, according to an on-chain update circulating on X. Another 52.54 million RLUSD remained unfrozen at the holding wallet. Etherscan showed the main receiving wallet holding about $88.5 million in RLUSD at 20:41 UTC, matching the two figures combined.

Ripple then froze about $200 million in RLUSD, on top of the more than $2 billion in USDT and USDC. Binance co-CEO Yi He credited the response: “Thanks to the Ripple team for promptly freezing approximately 200 million. User Funds are SAFU,” referring to Binance's emergency reserve fund.

Ripple senior vice president for stablecoins Jack McDonald said: “Ripple is closely monitoring reports of a potential exploit involving Binance and its attackers' RLUSD holdings and we are actively freezing affected funds. We're coordinating with relevant parties and stand ready to support any investigation and appropriate action to keep users protected.”

Does Tornado Cash explain the exit?

Tornado Cash, a mixer that obscures the trail of crypto payments, appeared only as funding for the address that prepared the attack. The report did not identify it as a destination for the post-hack ETH.

A precedent came after the Bybit hack, when North Korea's Lazarus Group converted 84.45% of stolen ETH into Bitcoin through THORChain, a cross-chain swap network, according to Bybit's CEO. Monero, a privacy coin designed to conceal senders, rose about 6% on Thursday, suggesting a possible rotation into privacy-focused assets, though the source did not establish that the Binance attacker used Monero.

The next enforcement window is the decision to reopen Aave's Ethereum V3 markets and Kamino's SOL/BTC market, neither of which carried a restart deadline. Until then, centralized issuers can block the stablecoin leg of a transfer, while decentralized venues can still turn blocked balances into ETH unless protocols maintain risk controls.