Binance Hack: Attacker Races DeFi Exits as $2B Frozen

A suspected hacker behind the drain of at least $5.5 billion from wallets linked to Binance is converting stolen stablecoins into Ethereum through decentralized exchanges before issuers can freeze the funds. Stablecoin issuers Tether and Circle have already blacklisted addresses tied to the attacker and blocked more than $2 billion from moving, while lending platform Aave froze its markets on Ethereum's main network to limit further exposure.

What happened on October 29

Blockchain data compiled from Etherscan and reported by Decrypt showed wallets tied to the suspected Binance hack swapping freezable stablecoins for Ethereum on decentralized exchanges such as Uniswap and Aave on October 29, 2026. Decrypt reported that wallets linked to the exchange were drained of at least $5.5 billion, with the total tally still climbing at the time of its report. Binance said it was investigating the security incident but did not confirm that customer funds were affected, according to Decrypt, though the outlet noted security researchers widely believed the exchange had been breached.

The attacker's method matters because of how stablecoins work. Tether and Circle, which issue USDT and USDC, can blacklist wallet addresses and freeze the tokens inside them, while ether has no issuer that can do the same. Decrypt reported that Tether and Circle moved to blacklist the suspected attacker's addresses, freezing more than $2 billion of those two tokens combined. Ether, by contrast, has no issuer that can freeze it, which is why the attacker is racing to convert stablecoins into ETH before more addresses are blocked.

The on-chain record shows specific transactions. According to Decrypt, wallets tied to the hack received tens of thousands of ETH from Uniswap contracts and borrowed 19,762 ETH on Aave against roughly $60 million in USDT, with no indication of a flaw in either application. The attacker also swapped 36 million RLUSD, Ripple's dollar-pegged stablecoin, for 15,439 ETH, while 52.54 million RLUSD remained unfrozen in the holding wallet, Decrypt reported, citing an on-chain update circulating on social media. Not all of the converted ether has moved onward: Decrypt reported that roughly 253,000 ETH, worth about $570 million, sat in two wallets with no outgoing transfers as of 22:07 UTC.

Decentralized finance platforms responded by restricting activity rather than waiting for funds to arrive. Aave froze its V3 markets on Ethereum mainnet, blocking new deposits and borrowing, Decrypt reported. Odysseas Lamtzidi, founder of security firm Phylax Systems, described one set of large borrow transactions as "contagion in full effect," according to a report republished by Yahoo Finance. Lending protocol Kamino issued its own statement distancing itself from the episode, saying it could "confirm that it is currently unaffected by the ongoing Binance situation," per Decrypt.

Why the loss estimate varies by source

Figures for the size of the drain differ slightly depending on when each outlet counted it, because the on-chain tally was still moving as reporters filed their stories. Decrypt's running count put the figure at a minimum of $5.5 billion. A separate account from crypto news outlet Bloomingbit cited an estimated outflow of about $5.7 billion and tied the incident to broader market losses, reporting that Bitcoin and Ethereum fell while Solana and XRP each slid more than 6% in the aftermath, with forced liquidations among leveraged traders surging. Bloomingbit's coverage of the DeFi response separately confirmed the more-than-$2-billion freeze total reported by Decrypt. The roughly $200 million gap between the $5.5 billion and $5.7 billion figures reflects the pace of a fast-moving, on-chain investigation rather than a factual contradiction between outlets; neither total is final, and Binance has not published its own confirmed loss figure.

Key figures

What this means for crypto users and readers

For readers who hold funds on Binance, the key fact is that Binance acknowledged an investigation but, as of Decrypt's reporting, had not confirmed that customer deposits, as opposed to hot wallets used for exchange operations, were affected. That distinction matters: a hot-wallet drain is an exchange-side security failure and is not, on its own, proof that individual account balances were lost. Readers with balances on Binance do not yet have confirmation either way from the company.

For readers who use DeFi lending and trading platforms, the episode illustrates why protocols such as Aave paused markets even though, per Decrypt's reporting, there was no sign of a flaw in either Uniswap or Aave's own code. The pause appears to be a precaution against the lending pools being used to launder stolen funds or against a liquidity shock if large, sudden borrows and swaps move ether's on-chain price. The stablecoin freezes also illustrate a tradeoff: issuers like Tether and Circle can claw back misused tokens, which protects other users of those stablecoins, but it means USDT and USDC are not fully bearer assets the way ether is, a gap the attacker in this case is explicitly exploiting by converting into ETH.

What remains unknown, based on the sources reviewed, is the final size of the loss, whether any individual customer balances were affected, the identity of the attacker, and how much of the diverted ether will ultimately be recovered, frozen through other means, or successfully moved off-chain. Binance has not released a confirmed loss figure, and none of the outlets reviewed here has independently verified one.