Newsletter

A wallet suspected to be associated with the hacker Binance received tens of thousands of ETH from a contract on Uniswap. Using approximately 60 million US dollars in USDT as collateral, they borrowed 19,762 ETH on Aave. Neither of the two applications showed any signs of vulnerabilities.

As of UTC at 22:07, there are approximately 253,000 ETH in the two wallets, valued at around 570 million US dollars, and no external transfers have occurred; moreover, ETH cannot be frozen by any issuer.

According to Binance, who is co-working with CEO He Yicheng, Ripple has frozen approximately $200 million of RLUSD. This amount, together with the more than $2 billion of USDT and USDC that were previously frozen, brings the total to over $2.2 billion.

According to the records of 10 wallets from Etherscan, 8 of them are marked as exploiters. The attackers are using decentralized exchanges such as Uniswap and Aave as "exits" to exchange stablecoins that can be frozen by the issuers for Ethereum, which cannot be frozen by anyone else.

Earlier today, wallets associated with the world's largest cryptocurrency exchange had at least $5.5 billion stolen, and the total amount is still rising. The company stated that they are investigating this security incident but have not confirmed whether user funds were affected. However, security experts generally believe that the exchange did indeed suffer a hacker attack. This incident is expected to become the largest hacker attack in the 18-year history of the cryptocurrency industry.

Stablecoin issuers Tether and Circle quickly added the addresses of suspected attackers to their blacklists to freeze some funds and make them unavailable. As centralized issuers, they have the authority to blacklist these addresses, preventing the transfer of their tokens; so far, over $2 billion in tokens from these two stablecoin issuers have been frozen. ETH does not have an issuer, so any dollars that were converted before the freeze took effect are beyond their control.

These exchanges are conducted through Uniswap, which is a decentralized exchange where transactions are automatically settled without any intervention from companies.

At UTC time 20:34, one relay wallet received 20,940 ETH (45.58 million US dollars) from the UniswapX contract of Uniswap. Another wallet received 3,552 ETH (over 8 million US dollars) at 20:47. Subsequently, these two wallets each received approximately 18,085 ETH (about 41 million US dollars) from the Uniswap contract, in two batches of 7,444 and 10,642 units respectively, as well as approximately 16,498 ETH (37.5 million US dollars), in two batches of 6,946 and 9,552 units respectively.

Aave is a lending application where users can deposit encrypted assets as collateral to borrow other cryptocurrencies. It also provides a second exit strategy. Between 20:57 and 21:01, a wallet deposited $10 million and then $50 million successively. Using this collateral, the user borrowed 3,271 ETH (worth $7.43 million) and 16,491 ETH (worth $37.47 million). This prompted cybersecurity expert and Phylax Systems founder Odysseas Lamtzidi to warn that the "contagion effect has become fully evident."

Aave subsequently froze its V3 market on the Ethereum mainnet, which will prevent new deposits and loans.

The decentralized finance protocol Kamino built on the Solana blockchain has also suspended its Solana and Bitcoin market as a preventive measure.

Kamino indicates: "We can confirm that at present, we are not affected by the ongoing Binance event. Out of extreme caution, we have temporarily suspended lending in the SOL / BTC markets. We are actively monitoring the situation and maintaining communication with various partners. Any further..."

ETH is continuously accumulating rather than circulating. A wallet labeled Exploiter 8 still held 195,460 ETH (444.2 million US dollars) at UTC time 22:03, while another wallet labeled Exploiter 11 received 57,891.77 ETH (131.6 million US dollars), totaling approximately 253,000 ETH, or about 570 million US dollars. The latter amount was obtained within 28 minutes through four transfers, with the path being Exploiter 4 to 5, 5 to 6, 6 to 7, and then to 11.

According to updates on the blockchain and information circulating on X, the attacker also exchanged 36 million RLUSD (US dollar-pegged stablecoins of Ripple) for 15,439 ETH, while 52.54 million RLUSD remain in the holding wallet without being frozen. Etherscan shows that the main receiving wallet held approximately 88.5 million US dollars in RLUSD at 20:41 on UTC, which is consistent with the sum of the aforementioned two figures.

According to Binance, who is co-operating with CEO, Ripple subsequently froze approximately $200 million. "Thanks to the team at Ripple for quickly freezing about $200 million. User funds are of utmost importance," He Yi wrote on X, referring to SAFU as the exchange's emergency reserve fund.

The Senior Vice President of Stablecoins, Ripple, stated in a declaration: "We at Ripple are closely monitoring reports regarding potential vulnerabilities in Binance and the fact that attackers possess RLUSD. We are actively freezing the affected funds. We are coordinating with relevant parties and are ready to support any investigations and appropriate actions necessary to protect our users."

Tornado Cash is a coin mixer that can obscure the traces of encrypted payments; it currently seems to appear only as the source of funds for setting up the addresses used in this attack.

After being attacked by hackers on Bybit, North Korea's Lazarus Group managed to exchange 84.45% of the stolen ETH for Bitcoin through the cross-chain exchange network Thorchain, according to the former CEO of Bybit. Privacy coins Monero rose by about 6% on Thursday, indicating that the funds may have shifted towards privacy coins.