Wallets linked to the suspected Binance hack received tens of thousands of ETH from Uniswap contracts and borrowed 19,762 ETH on Aave against approximately $60 million in USDT. There is no indication that either application was exploited.

As of 22:07 UTC, about 253,000 ETH—worth roughly $570 million—was held in two wallets without any outgoing transfers. Unlike centralized stablecoins, ETH has no issuer that can freeze the asset.

The activity came as the attacker behind wallets draining Binance used decentralized exchanges and lending protocols as exit routes. Etherscan records for 10 wallets, eight of which are labeled as exploiters, show the suspected attacker converting stablecoins that issuers can freeze into ETH, which cannot be frozen by an issuer.

Wallets linked to the world’s largest crypto exchange were drained of at least $5.5 billion earlier on Thursday, with the total still increasing. Binance said it was investigating a security incident but did not confirm whether user funds were affected. Security experts widely believe the exchange was hacked. If confirmed, the incident would be the largest hack in the crypto industry’s 18-year history.

Stablecoin issuers Tether and Circle moved quickly to blacklist addresses associated with the suspected attacker, freezing part of the funds and making them inaccessible. As centralized issuers, both companies can blacklist addresses so their tokens cannot move. More than $2 billion in USDT and USDC has been frozen so far by different stablecoin providers. ETH has no issuer, meaning funds converted into ETH before a freeze can no longer be blocked in the same way.

The swaps were routed through Uniswap, a decentralized exchange where trades settle automatically without a company acting as an intermediary. One relay wallet received 20,940 ETH, valued at $45.58 million, from Uniswap’s UniswapX contract at 20:34 UTC. Another received 3,552 ETH, worth more than $8 million, at 20:47 UTC.

Two subsequent wallets received approximately 18,085 ETH, worth around $41 million, from Uniswap contracts in batches of 7,444 ETH and 10,642 ETH. They also received about 16,498 ETH, valued at $37.5 million, in batches of 6,946 ETH and 9,552 ETH.

Aave, a lending application that allows users to deposit crypto as collateral and borrow other assets, provided a second exit route. Between 20:57 and 21:01 UTC, one wallet deposited $10 million and then $50 million in USDT. Against those deposits, it borrowed 3,271 ETH, worth $7.43 million, and then 16,491 ETH, worth $37.47 million. The borrowing route reaches the same destination as the swaps: the deposited stablecoins stay behind as collateral, while the borrowed ETH carries no issuer with the power to freeze it.

The transactions prompted Odysseas Lamtzidi, founder of cybersecurity company Phylax Systems, to warn of “contagion in full effect.”

Update: They just approved AAVE. Contagion in full effect — Odysseus | phylax.systems (@odysseas_eth) October 29, 2026

Aave has since frozen its V3 markets on Ethereum mainnet, blocking new deposits and borrowing. The step underlines a structural difference in how the industry can respond: stablecoin issuers blacklist individual addresses, while decentralized protocols pause entire markets.

Kamino, a decentralized finance protocol built on Solana, also paused its Solana and Bitcoin markets as a precaution. Kamino said it was unaffected by the Binance situation and that it had temporarily paused borrowing in the SOL/BTC market while monitoring developments and communicating with partners.

Kamino can confirm that it is currently unaffected by the ongoing Binance situation Out of an abundance of caution, we have temporarily paused borrowing in the SOL/BTC Market We are actively monitoring the situation and are in communication with various partners. Any further… — Kamino (@kamino) October 29, 2026

The ETH has accumulated in the suspected exploiter wallets rather than moving onward. A wallet labeled Exploiter 8 held 195,460 ETH, worth $444.2 million, at 22:03 UTC. Another 57,891.77 ETH, worth $131.6 million, had reached a wallet labeled Exploiter 11. Together, the holdings totaled about 253,000 ETH, or approximately $570 million.

The second group of funds arrived after four transfers over 28 minutes: from Exploiter 4 to Exploiter 5, from 5 to 6, from 6 to 7, and from 7 to 11.

The attacker also exchanged 36 million RLUSD, Ripple’s dollar-backed stablecoin, for 15,439 ETH. A further 52.54 million RLUSD remained unfrozen in the holding wallet, according to an on-chain update circulating on X. Etherscan showed the main receiving wallet holding approximately $88.5 million in RLUSD at 20:41 UTC, matching the combined value of those two amounts. Whether the remaining RLUSD is frozen in full, whether the accumulated ETH starts moving, whether Aave and Kamino reopen their paused markets, and whether Binance details the impact on user funds are the immediate developments to watch.

Binance co-CEO Yi He said Ripple had since frozen about $200 million in RLUSD, in addition to more than $2 billion in USDT and USDC frozen by stablecoin providers.

“Thanks to the Ripple team for promptly freezing approximately 200 million. User Funds are SAFU,” Yi He wrote on X, referring to Binance’s emergency reserve fund.

“Ripple is closely monitoring reports of a potential exploit involving Binance and its attackers’ RLUSD holdings and we are actively freezing affected funds,” Jack McDonald, Ripple’s senior vice president for stablecoins, said in a statement. “We’re coordinating with relevant parties and stand ready to support any investigation and appropriate action to keep users protected.”

Ripple is closely monitoring reports of a potential exploit involving Binance and its attackers’ RLUSD holdings and we are actively freezing affected funds. We’re coordinating with relevant parties and stand ready to support any investigation and appropriate action to keep users… — Jack McDonald (@JackMcDonald) October 29, 2026

Tornado Cash, a mixer that obscures the trail of crypto payments, so far appears only as a funding source for the address that established the attack.

For a read on how incidents of this scale have unfolded before, the Bybit hack is the most recent precedent: after that attack, North Korea’s Lazarus Group converted 84.45% of the stolen ETH into Bitcoin through Thorchain, a cross-chain swap network, according to Bybit’s CEO. Monero, a privacy coin that conceals the identities of transaction participants, rose about 6% on Thursday, suggesting a possible rotation into the privacy coin.

Source: https://decrypt.co/382194/binance-hack-exit-ramps-defi-exchange-ethereum