Wallets draining Binance of at least $5.5 billion are routing funds through decentralized exchanges to convert frozen stablecoins into Ethereum, which has no issuer and cannot be blacklisted.
The attacker moved stolen funds through Uniswap and Aave. On Uniswap, multiple wallets received batches of ETH between 20:34 and later timestamps. One wallet got 20,940 ETH ($45.58 million), another received 3,552 ETH (over $8 million), and two additional wallets took in about 18,085 ETH and 16,498 ETH in separate batches.
Aave, a lending protocol, served as a second exit route. Between 20:57 and 21:01 UTC, one wallet deposited $10 million then $50 million in USDT and borrowed 3,271 ETH and 16,491 ETH against it. Phylax Systems founder Odysseas Lamtzidi warned of "contagion in full effect."
Aave froze its V3 markets on Ethereum mainnet in response. Kamino, a DeFi protocol on Solana, paused its Solana and Bitcoin markets as a precaution.
Stablecoin issuers moved to contain the breach. Tether and Circle blacklisted suspected attacker addresses, freezing over $2 billion combined. Ripple froze approximately $200 million in RLUSD after the attacker swapped 36 million RLUSD for 15,439 ETH. Binance co-CEO Yi He said user funds are "SAFU," referring to the exchange's emergency reserve.
As of 22:03 UTC, wallets labeled Exploiter 8 and Exploiter 11 held roughly 253,000 ETH or $570 million combined. The attacker also moved RLUSD, with 52.54 million RLUSD remaining unfrozen at the holding wallet.
Tornado Cash appeared only as funding for the setup address. Privacy coin Monero rose about 6% on Thursday, suggesting possible rotation into privacy assets similar to patterns seen after the Bybit hack, when North Korea's Lazarus Group converted 84.45% of stolen ETH to Bitcoin through cross-chain swap network Thorchain.