UPDATE: Binance Exploiter Uses DeFi Protocols to Launder Stolen Assets
CIE News ·
Update to Binance investigates $6.3 billion security breach and pauses withdrawals
Based on reporting by BeInCrypto; not yet independently confirmed.
Following the Binance exploit, an attacker converted stolen USDT across Aave, Uniswap, and SunSwap, prompting Aave lending markets to freeze across 16 networks.
The attacker behind the Binance security breach utilized Aave, Uniswap, and SunSwap to convert stolen Tether (USDT) into unfreezable assets late on October 29. As previously reported, Binance disclosed an unauthorized withdrawal incident with an estimated impact of $6.3 billion after an attacker accessed a service container via a compromised DevOps engineer's laptop.
Between 20:58 and 21:01 UTC on October 29, the exploiter supplied 60 million USDT to Aave V3 on Ethereum and borrowed 19,762 Wrapped Ether (WETH), valued at roughly $44.6 million, leaving the collateralized USDT stranded. The attacker also swapped 435 million USDT for Ether (ETH) on Uniswap and traded 234 million USDT for 638.2 million TRON (TRX) on SunSwap.
Following the laundering activity, Aave Labs, TokenLogic, and Certora initiated emergency safeguards to freeze lending markets across 16 networks to prevent additional draining. Binance reported that partners including Tether and Circle have frozen approximately $3 billion in stolen assets on-chain, while exchange withdrawals remain paused for security upgrades.
Key facts
- 19,762 WETH borrowed on Aave
- 435M USDT swapped on Uniswap
- 234M USDT converted on SunSwap
- Lending frozen on 16 networks
Read the original at BeInCrypto