⏱ 3 min read
Two addresses held about 253,000 ETH with no outflows as Aave froze V3 on Ethereum and stablecoin issuers froze funds tied to the suspected attacker.
Wallets the report links to a binance hack used decentralized apps as exit ramps, swapping freeze‑prone stablecoins into Ethereum and borrowing ETH against USDT collateral, according to Etherscan records. As those flows picked up, Aave froze its V3 markets on Ethereum and Kamino paused borrowing in its SOL/BTC market.
DeFi route swaps freeze‑prone tokens for ETH
Etherscan records for 10 wallets, eight labeled as exploiters, show Uniswap and Aave facilitating the moves. The report says there was no sign of a flaw in either app. On Uniswap, a relay wallet received 20,940 ETH at 20:34 UTC and another got 3,552 ETH at 20:47. Later wallets took in batches of 7,444 ETH and 10,642 ETH (about 18,085 ETH combined), and 6,946 ETH and 9,552 ETH (about 16,498 ETH), via Uniswap contracts.
On Aave between 20:57 and 21:01 UTC, one wallet deposited $10 million and then $50 million in USDT, borrowing 3,271 ETH and then 16,491 ETH against it, or 19,762 ETH in total. ETH has no issuer that can freeze it, so every dollar converted before a blacklist lands is beyond a stablecoin issuer’s control. Cybersecurity founder Odysseas Lamtzidi called it “contagion in full effect.” Aave subsequently froze its V3 markets on Ethereum mainnet, which blocks new deposits and borrowing, cutting off that particular route.
▼ 2.75%
▼ 3.55%
Prices as of 2026-10-29 23:02 UTC. Source: CoinGecko.
Stablecoin freezes mount as ETH piles up
Two addresses labeled Exploiter 8 and Exploiter 11 held roughly 195,460 ETH and 57,891.77 ETH, respectively, together about 253,000 ETH (roughly $570 million), with no outgoing transfers as of 22:07 UTC. One of those piles arrived after four hops in 28 minutes through addresses the report labels Exploiters 4 to 7 and 11.
Earlier, the report said wallets linked to the world’s largest crypto exchange were drained of at least $5.5 billion, with the total still climbing. The company said it was investigating the security incident and did not confirm user funds were affected.
Stablecoin issuers moved to freeze suspected funds. Tether and Circle blacklisted addresses, with more than $2 billion of USDT and USDC frozen so far, according to the report. Ripple’s RLUSD was also in the flow: the attacker swapped 36 million RLUSD for 15,439 ETH while 52.54 million RLUSD remained unfrozen at a holding wallet; Etherscan showed about $88.5 million in RLUSD at 20:41 UTC, which matches those two figures combined. Binance co-CEO Yi He wrote, “Thanks to the Ripple team for promptly freezing approximately 200 million. User Funds are SAFU.” Ripple executive Jack McDonald said, “We are actively freezing affected funds.” Taken together, the reported freezes put the total above $2.2 billion.
Kamino, a DeFi protocol on Solana, said it paused borrowing in its SOL/BTC market as a precaution and that it was unaffected. Tornado Cash appears so far only as funding for the address that set up the attack, the report adds.
The flow data shows where tokens moved and the size of those piles; it does not establish who controls the labeled wallets. The next constraint on this route is Aave’s V3 freeze on Ethereum, which stops new deposits and borrowing while it remains in place.
Source: Decrypt.
This article was written with AI assistance and reviewed by an editor.
This content is for informational purposes only and does not constitute financial advice.
🧠 HafidWatch Take
The relatively small portion of ETH linked to Aave borrowing suggests that the bulk of the seized funds remain tied up in complex swaps and conversions, limiting flexibility for the attacker. This concentration could influence the timing and conditions under which frozen assets might be unfrozen, as resolving the Uniswap and RLUSD-related holdings may require broader coordination. Monitoring subsequent on-chain activity or changes in these specific token flows might provide clearer indications of who controls the wallets and their next moves.
Daily crypto intelligence. Before the market opens.
Including the Divergence Index — the sentiment gap no other newsletter tracks. Free, every morning at 7:30am ET.
✓ Free forever · ✓ No spam · ✓ 50+ sources monitored
