Wallets linked to Binance were drained of at least $5.5 billion on October 29, and the attacker is now hunting for ways to cash out, according to Decrypt’s report on Yahoo Finance. The total was still climbing in the October 30 update. The Binance hack has pulled decentralized finance into the story, because the attacker is routing funds through Uniswap and Aave to swap assets that issuers can freeze for Ethereum that nobody can.
Binance said it was investigating a security incident and had not confirmed that user funds were affected. Neither the final amount nor the label itself is settled. We use the phrase Binance hack only as shorthand for the incident tied to Binance-linked wallets, and every figure below names its source.
This analysis follows the on-chain trail, the lending protocols that hit pause, the stablecoin freezes, and what the next few weeks could bring. For the exchange-side view of the first hours, see our earlier piece on the Binance hack probe and the frozen funds.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Happened in the Binance Hack on October 29
The first public signal was a set of large movements out of wallets associated with Binance. By the time Decrypt published, the reported drain stood at a floor of $5.5 billion, and the outlet said the number was still rising. That phrasing matters. A floor means no one has produced a final count, and the figure will likely shift as investigators trace more addresses.
Binance’s own position is narrower than the headlines. The exchange said it was looking into a security incident. It did not confirm that customer funds were touched. Those two statements can both be true if the drained wallets held corporate or operational balances, but nothing on the record tells us which wallets they were, so we treat that point as open.
What makes this episode different from a typical exchange breach is the second act. Instead of sitting on the proceeds, the attacker began swapping and borrowing on public DeFi venues within hours. That pulled Aave, Kamino and Uniswap into an incident they did not start, and it turned a single-venue problem into a market-structure story.
| Item | What was reported | Status |
|---|---|---|
| Loss | At least $5.5 billion drained from Binance-linked wallets, total still rising | Reported by Decrypt, not final |
| Binance position | Investigating a security incident, user fund impact not confirmed | Binance statement as reported |
| Exit route | Stablecoins swapped for Ethereum through Uniswap | Reported by Decrypt |
| Aave activity | $10 million and $50 million USDT deposits, ETH borrowed against them | Reported by Decrypt |
| Aave response | V3 markets on Ethereum mainnet frozen for new deposits and borrowing | Reported by Decrypt |
| Kamino response | Solana and Bitcoin markets paused as a precaution | Reported by Decrypt |
| Stablecoin freezes | More than $2 billion in USDT and USDC, about $200 million in RLUSD | Reported, RLUSD figure per Binance co-CEO Yi He |
| Final amount stolen | Unknown | Unconfirmed |
Why the Binance Hacker Needs Exit Ramps
Stolen crypto is only worth what the thief can move and spend. A balance that sits in an asset someone else controls is a liability, not a prize. That is the logic behind the exit-ramp hunt Decrypt describes: the attacker wants out of assets that can be switched off and into assets that cannot.
Freezable assets versus assets nobody can freeze
USDT, USDC and RLUSD are issued by companies. Those companies can blacklist an address, and a blacklisted balance stops moving. Ether has no issuer and no administrator, so no company can lock a wallet that holds it. Swapping the first group for the second is the single most useful step a thief can take after a large theft, and Decrypt reports the attacker is doing exactly that through Uniswap.
Why DeFi venues are the natural next stop
Centralized exchanges check identities and can reverse or hold deposits. Decentralized exchanges and lending markets run on smart contracts that accept any wallet that follows the rules. Speed is the other draw. A swap on Uniswap settles in one transaction, and a deposit-and-borrow loop on Aave takes seconds. For someone racing a freeze, those minutes decide how much escapes.
The Aave Trail: Four Minutes and $60 Million in USDT
Decrypt’s on-chain reading gives the sharpest example of the strategy. One wallet deposited $10 million in USDT on Aave and then $50 million more. It borrowed 3,271 ETH, valued at $7.43 million, against the first deposit and 16,491 ETH, valued at $37.47 million, against the second. All of it happened between 20:57 and 21:01 UTC, a window of about four minutes.
The arithmetic below is ours, built from the reported figures. It shows how consistent the borrowing was. Both loans landed within a point of each other, near three quarters of the collateral value. That pattern looks like a deliberate push toward the borrowing ceiling rather than a cautious position.
| Step | USDT deposited | ETH borrowed | Borrow value | Borrow vs deposit (our math) |
|---|---|---|---|---|
| First deposit | $10 million | 3,271 ETH | $7.43 million | 74.3% |
| Second deposit | $50 million | 16,491 ETH | $37.47 million | 74.9% |
| Combined | $60 million | 19,762 ETH | $44.90 million | 74.8% |
| Implied ETH price | n/a | n/a | About $2,272 per ETH | Both loans line up |
Why borrow instead of swap? One plausible reading is that a loan turns a freezable asset into ether without a sale, and it skips the price impact a large swap would cause. The USDT locked as collateral could still be frozen by its issuer, but the borrowed ether is already gone. We cannot confirm intent, and the reporting does not say whether the attacker ever repays. Still, the structure fits the exit-ramp story neatly.
Aave Freezes V3 Markets on Ethereum Mainnet
Aave responded by freezing its V3 markets on Ethereum mainnet. Per Decrypt, the freeze blocks new deposits and new borrowing. It does not undo the loans already taken, and it cannot pull ether back out of the attacker’s wallets. What it does is stop that wallet, and any copycat, from repeating the loop at larger size.
The tradeoff is real. A freeze protects the pool but also locks out ordinary users who want to open positions. Lenders lose fresh demand for their capital, and borrowers cannot add leverage or refinance with new debt. Protocol teams accept that cost because the alternative is letting an attacker use the pool as a laundering lane while the exchange, the issuers and the investigators scramble.
Speed also separates good responses from poor ones. The Aave activity ran for four minutes, and a freeze can only follow once someone spots the pattern. Governance-controlled pauses are slower than automated circuit breakers, which is the central design question the incident raises for every lending market that depends on human sign-off.
Kamino Pauses Solana and Bitcoin Markets
Kamino, a lending protocol on Solana, paused its Solana and Bitcoin markets as a precaution. The word precaution carries weight. Decrypt’s reporting on the Aave trail does not say the attacker used Kamino. The pause reads as a risk team deciding that an unknown exposure is worse than a short outage.
That logic spreads quickly across chains. Funds that leave Ethereum can bridge elsewhere, and a protocol on another network has no way to know in advance whether tainted assets are about to arrive. Pausing the Bitcoin-linked market in addition to the Solana one suggests Kamino wanted the broadest possible buffer while it assessed the damage.
For depositors, a pause is annoying but usually temporary. The bigger signal is behavioral. When two unrelated protocols on two different chains stop taking new business within the same news cycle, it tells the market that DeFi risk teams now treat a major exchange incident as a live threat to their own pools.
Stablecoin Issuers Freeze More Than $2 Billion
The issuers moved too. Stablecoin issuers reportedly froze more than $2 billion in USDT and USDC. Binance co-CEO Yi He said Ripple froze about $200 million in RLUSD, according to the same reporting. Together that is roughly $2.2 billion locked in place, and the exit-ramp hunt exists precisely because those freezes are working.
Put the two headline numbers side by side and the picture sharpens. If the frozen pool were measured against the $5.5 billion floor, it would cover roughly 36 to 40 percent. We offer that as a rough scale check only. The reports do not establish that the frozen balances and the drained balances are the same funds, and the final loss number is still open.
The freeze figures also connect to the exchange’s own actions in the first day. Our earlier coverage of the Binance withdrawal pause and the Tether and Circle freezes tracks how the first estimates evolved. The numbers there differ from the ones above because each outlet counted at a different hour, which is why this piece sticks to the conservative, sourced floor.
Contagion in Full Effect: The Phylax Warning
Odysseas Lamtzidi, founder of Phylax Systems, summed up the moment in three words. He described the situation as “contagion in full effect.” The quote comes through Decrypt’s report, and it captures what the protocol pauses imply even if the final loss turns out smaller.
Contagion in this context means stress that jumps from one venue to the next through shared assets and shared liquidity. An exchange breach becomes a lending-market problem when stolen funds enter the pools. It becomes a stablecoin problem when issuers start freezing balances. Each step forces a new group of operators to make fast decisions with partial information.
His warning is best read as a prompt for operators rather than a market forecast. If the attacker keeps probing new venues, the list of protocols forced to pause could grow beyond the two we know about.
What Is Confirmed and What Is Not
Incidents like this generate confident headlines on thin evidence. Separating the solid claims from the open ones is the most useful thing a reader can do while the investigation runs.
- Reported with a source: at least $5.5 billion drained from Binance-linked wallets, per Decrypt, with the total still rising.
- Reported with a source: the attacker used Uniswap to swap stablecoins for Ethereum, and one wallet ran the Aave deposit-and-borrow loop between 20:57 and 21:01 UTC.
- Reported with a source: Aave froze its V3 markets on Ethereum mainnet and Kamino paused its Solana and Bitcoin markets.
- Reported with a source: more than $2 billion in USDT and USDC frozen, plus about $200 million in RLUSD per Yi He.
- Unconfirmed: that this was conclusively a Binance hack. Binance has not confirmed that user funds were affected.
- Unconfirmed: the exact final amount stolen, which keeps changing.
Other outlets have published higher estimates. Genfinity cited on-chain trackers at roughly $5.6 billion, and a Crypto Economy headline framed the event as possibly the largest hack in crypto history. We keep the lower, better-sourced figure as the working number, because a floor that rises later is easier to defend than a ceiling that gets revised down.
Market Impact: Liquidity, Lending Rates and Trust
The reporting we can verify does not include price moves, so we will not invent any. What it does show is a stress test of the plumbing. Two lending protocols throttled activity, three stablecoin issuers froze balances, and a decentralized exchange processed swaps it had no power to stop.
Lenders on a frozen market face an awkward mix. Their existing deposits keep earning, but new capital cannot enter, and borrowers who need to roll positions lose a venue. Over a longer stretch, that shifts liquidity toward markets that stayed open, which then absorb the same attacker risk. Traders watching DeFi lending rates should expect noise until the pauses lift.
Trust is the quieter casualty. Users who thought a large exchange sat safely behind layers of controls now watch a multibillion-dollar outflow in near real time. A DEV Community post already frames the event as a test of proof-of-reserves claims. We read that as an early opinion piece, not evidence, but it shows where the debate is heading.
Competitive Comparison: How Each Layer Responded
No single actor can stop a thief who moves across venues. Each layer of the system holds a different lever, and the incident shows which levers exist. The table below compares what each player did, using only the reported facts.
| Player | Action reported | What it can stop | What it cannot stop |
|---|---|---|---|
| Binance | Investigating, no user-fund impact confirmed | Further movement from its own systems | Funds already on-chain |
| Aave | Froze V3 markets on Ethereum mainnet | New deposits and borrowing | Loans already taken, ether already withdrawn |
| Kamino | Paused Solana and Bitcoin markets | New exposure to possibly tainted funds | Activity on other protocols |
| USDT and USDC issuers | More than $2 billion frozen | Movement of stablecoin balances | Assets already swapped into ether |
| Ripple (RLUSD) | About $200 million frozen, per Yi He | Movement of RLUSD balances | Assets already swapped into ether |
| Uniswap | Used as an exit by the attacker, per Decrypt | Little, since swaps run through open contracts | Swaps by any wallet |
The pattern is clear. Issuers hold the strongest lever over stablecoins, lending protocols can close their own doors, and open swap venues have almost no brakes. That asymmetry explains why the attacker aims for Ethereum. Every freeze lever sits upstream of the final conversion step.
Historical Context: Why This Differs From Earlier Breaches
Past exchange breaches mostly stayed inside one venue until the stolen funds went dark. The usual playbook involved a quick hop through mixers or bridges and a slow cash-out over weeks. Responders could watch a small number of paths and coordinate with a handful of issuers.
Here, the speed and the scale of DeFi integration change the math. Lending protocols now hold billions in liquid collateral, and anyone can interact with them in seconds. We have seen smaller versions of the same dynamic this year. Our coverage of the Polymarket third-party breach and reimbursement showed how a venue outside the hacked party gets pulled into cleanup, and the Keystone wallet key theft showed how a single stolen key can put thousands of devices at risk.
Those incidents were far smaller in dollar terms than the one reported now, and we do not import numbers from older hacks into this story. The common thread is structural. Custody failures rarely stay contained once assets can move through permissionless contracts, and the defenders’ tools depend on who controls each asset along the path.
Lessons for Security Teams and Traders
For protocol and exchange security teams
Automated guardrails beat meetings. A lending market that can throttle new borrowing when a single wallet takes out tens of millions in minutes buys time that governance votes cannot. Teams should also maintain live contact paths with stablecoin issuers, because a freeze request that arrives within minutes preserves far more value than one that arrives after the swap.
Exchanges should review hot wallet limits and withdrawal-approval design. Our cybersecurity coverage tracks the breaches and zero-days that shape these decisions.
For users and traders
Check your own exposure before the next headline. If you use API keys with an exchange, rotate them, restrict permissions and lock withdrawal addresses. We laid out six concrete checks in our guide to Binance API key security after the freeze. If you lend or borrow on a paused DeFi market, expect delays and avoid assuming positions can be adjusted on your schedule.
Do not act on social posts that claim to know which wallets are safe or which tokens will be frozen next. Wait for statements from Binance, the protocols and the issuers themselves.
Five Predictions for the Next Few Weeks
These are our expectations, not reported facts. Each rests on the pattern of the first 24 hours.
- More protocols will add automated circuit breakers. The Aave and Kamino pauses showed the value of acting fast. Expect lending teams to propose rules that throttle borrowing when one address moves outsized collateral in minutes.
- The reported loss figure will keep changing. A floor of $5.5 billion that is still rising rarely lands cleanly. Expect revisions in both directions as wallets are traced and freezes are counted.
- Binance will face pressure for a detailed accounting. Users and regulators will want to know which wallets were drained and whether customer balances were touched. The exchange has not yet confirmed that user funds were affected.
- Stablecoin issuers will draw scrutiny from both sides. Supporters will point to the freezes as proof the system works. Critics will question the speed and the policies behind them.
- The attacker will keep probing for open venues. As long as some markets accept deposits and swaps, the hunt for exit ramps continues. Operators outside Aave and Kamino should expect to be tested.
Frequently Asked Questions
Was Binance definitively hacked?
Not confirmed. Binance said it was investigating a security incident and had not confirmed that user funds were affected. Outlets such as Decrypt report that wallets linked to Binance were drained of at least $5.5 billion.
How much was stolen?
The cited figure is at least $5.5 billion, and the total was still rising on October 30. Some outlets published higher estimates. The exact final amount is unconfirmed.
Why is the attacker using Uniswap and Aave?
Per Decrypt, the goal is to swap stablecoins that issuers can freeze for Ethereum that no one can freeze. One wallet deposited $10 million and then $50 million in USDT on Aave and borrowed ether against it within about four minutes.
What did Aave do?
Aave froze its V3 markets on Ethereum mainnet, which blocks new deposits and new borrowing. The freeze does not reverse loans that were already taken.
What did Kamino do?
Kamino paused its Solana and Bitcoin markets as a precaution. The reporting does not say the attacker used Kamino.
How much has been frozen?
Stablecoin issuers reportedly froze more than $2 billion in USDT and USDC. Binance co-CEO Yi He said Ripple froze about $200 million in RLUSD.
Can Ethereum be frozen like a stablecoin?
No. Ether has no issuer that can blacklist an address, which is why the attacker is converting stablecoins into it.
