UPDATE: Binance hacker launders $25M through THORChain and borrows on Aave
CIE News ·
Update to UPDATE: Binance freeze recovers $2.85B after $6.4B hack
Confirmed by independent sources.
Elliptic reported an automated script siphoned Binance exploit funds at up to $7 million an hour, moving $25 million via THORChain and borrowing 19,762 ETH on Aave.
On October 31, 2026, Elliptic reported that the attacker behind the Binance exploit deployed an automated 24/7 script to siphon stolen funds across decentralized finance protocols. Following the previously reported $6.3 billion hot-wallet theft, the attacker laundered roughly $25 million through THORChain, $5.3 million through SunSwap, and $1.8 million via Bitget Swap using programmatic transactions that self-corrected whenever cross-chain bridges rejected them.
The laundering script operated at speeds reaching $7 million per hour, according to Elliptic. During the initial breach, the attacker used an Ethereum EIP-7702 delegation batch to transform the exchange's wallet into a sweeper contract. The hacker subsequently deposited $60 million in Tether (USDT) collateral into lending platform Aave to borrow 19,762 Ether (ETH).
Decrypt reported that Aave paused its V3 Ethereum mainnet markets to halt fresh borrowing and deposits following the loans. TRM Labs and Elliptic previously linked the multi-chain theft to North Korea's state-backed hacking unit TraderTraitor, also known as the Lazarus Group.
Key facts
- $25M via THORChain
- 19,762 ETH borrowed on Aave
- Laundering hit $7M per hour
- Used EIP-7702 delegation
Read the original at trmlabs.com