30 October 2026 (Navroze Bureau) The cryptocurrency industry is facing a major security crisis after a suspected hacker linked to a massive Binance security breach began moving stolen digital assets through decentralised finance (DeFi) platforms in an attempt to convert them into cryptocurrencies that are harder to freeze.
According to blockchain transaction records reported by Decrypt on October 29, wallets associated with the suspected attacker were using platforms such as Uniswap and Aave to exchange stablecoins for Ethereum. The activity came as cryptocurrency companies and token issuers rushed to freeze assets linked to the incident.
The estimated financial impact of the Binance security breach has reached approximately $6.3 billion, according to the exchange’s initial assessment. Binance has said that customer funds remain safe and that it will cover the losses through company resources and its Secure Asset Fund for Users (SAFU).
Hacker Moves Stablecoins Into Ethereum
Blockchain records showed that wallets associated with the suspected attacker were converting stablecoins, including USDT and RLUSD, into Ethereum.
Stablecoins such as USDT, issued by Tether, and RLUSD, issued by Ripple, can be frozen by their respective issuers under certain circumstances. Ethereum, however, does not have a central issuing authority capable of freezing individual wallet balances.
This difference appears to have influenced the attacker’s strategy. By converting stablecoins into ETH, the suspected hacker could potentially move a portion of the funds beyond the direct freezing powers of stablecoin companies.
Data reported by Decrypt showed that several wallets received large amounts of Ethereum through Uniswap contracts. The transactions involved multiple transfers, making it difficult to track the movement of the assets through a single wallet.
Aave and Uniswap Come Under Attention
The attacker also reportedly used Aave, a decentralised lending protocol, to deposit USDT as collateral and borrow Ethereum.
According to transaction records, one wallet deposited approximately $60 million in USDT and borrowed around 19,762 ETH, valued at roughly $45 million at the time of the transactions.
The activity attracted attention from blockchain security experts, who warned that the incident could affect other DeFi platforms if the attacker continued using them to move assets.
Aave subsequently froze markets to prevent new deposits and borrowing activity. Its risk team explained that the decision was taken as a precautionary measure to stop the suspected attacker from opening new positions using stolen assets.
Uniswap, meanwhile, was used for swaps that were automatically executed through smart contracts. The activity highlighted the challenges of responding to suspicious transactions on decentralised platforms, where there is no traditional central operator controlling every trade.
DeFi Platforms Pause Markets to Limit Risk
The security incident prompted several DeFi platforms to take emergency action.
Aave’s risk team coordinated with security partners and technical teams to freeze affected markets across multiple blockchain networks. The measure was designed to prevent new lending and borrowing positions while allowing existing users to repay loans and withdraw eligible assets.
Kamino, a decentralised finance protocol operating on the Solana blockchain, also paused its Solana and Bitcoin markets as a precaution.
These decisions reflected concerns that stolen assets could be used as collateral or exchanged through lending and trading platforms before blockchain investigators and token issuers could intervene.
The freezes also created uncertainty among ordinary DeFi users, particularly those who depend on lending markets for borrowing, depositing collateral and accessing liquidity.
Billions of Dollars in Assets Frozen
Cryptocurrency companies and blockchain networks moved quickly to restrict the movement of funds linked to the suspected breach.
Tether and Circle reportedly blacklisted addresses associated with the attacker, freezing significant quantities of USDT and USDC. Ripple also froze approximately $200 million in RLUSD linked to the incident, according to Binance co-CEO Yi He.
Binance said that approximately $3 billion in affected assets had been frozen on-chain as the investigation progressed. A separate Reuters report put the total amount frozen at around $2.54 billion at the time of its reporting, reflecting the changing figures during the response.
The recovery effort involved stablecoin issuers, blockchain intelligence firms, cryptocurrency platforms and other industry partners.
How Did the Binance Security Breach Happen?
Binance’s initial investigation suggested that a compromised laptop belonging to a DevOps engineer may have allowed an attacker to gain access to a service container and submit unauthorised withdrawal transactions.
The company said it had found no evidence that wallet private keys were leaked. It also temporarily suspended deposits and withdrawals on affected networks while conducting security checks.
Blockchain intelligence firm TRM Labs estimated that approximately $6.36 billion in cryptocurrency was moved from Binance wallets across 10 blockchains on October 29. The firm attributed the attack to TraderTraitor, a North Korean-linked hacking group, based on its investigation. This attribution has not been independently confirmed by Binance.
The scale of the incident has raised concerns about the security of cryptocurrency exchanges and the risks associated with managing large amounts of digital assets across multiple blockchain networks.
Binance Assures Customers Their Funds Are Safe
Binance has maintained that customer funds remain safe despite the security incident. The exchange said it would cover all losses using its SAFU fund and company resources.
Co-founder Changpeng Zhao also commented on the incident, describing it as an apparent hack and expressing confidence that users would be fully covered.
The company has been working with law enforcement agencies, blockchain intelligence firms and cryptocurrency partners to trace the stolen assets and prevent further transfers.
Binance also said it would publish an updated proof of reserves after completing the necessary security measures.
Cryptocurrency Industry Faces Fresh Security Questions
The incident has once again highlighted the vulnerabilities facing the global cryptocurrency industry. While blockchain transactions are publicly visible, tracing and recovering stolen funds can be difficult when attackers use multiple wallets, decentralised exchanges and cross-chain transfers.
The response has also exposed the complicated relationship between decentralisation and emergency security measures. DeFi platforms offer users access to financial services without traditional intermediaries, but freezing markets can become necessary when stolen funds threaten the wider ecosystem.
For now, blockchain investigators and cryptocurrency companies are continuing to monitor the suspected attacker’s wallets. The final amount recovered, the identity of those responsible and the full technical details of the breach remain under investigation.