Binance halted withdrawals to conduct security checks and decentralized lender Aave froze its V3 Ethereum markets after an attacker drained up to $5.8 billion from the crypto exchange’s hot wallets. Aave intervened after the exploiter deposited stolen USDT as collateral to borrow 20,000 WETH, while the attacker also began liquidating stolen altcoins by selling 1.2 million UNI on Uniswap and swapping PEPE for ETH. Roughly 40 minutes after the initial breach, the attacker used a still-active EIP-7702 delegation on the “Binance 14” wallet to sweep another $201.2 million, including 200.4 million USDT and 369.8 ETH.
Binance co-CEO Yi He said Ripple froze roughly $200 million tied to the incident, adding to the more than $1.567 billion in USDT frozen by Tether and $823 million in USDC blocked by Circle in coordination with law enforcement. Cross-chain protocol USDT0 also temporarily paused USDT transfers between Ethereum and Tron as a precautionary measure, while the attacker moved $116 million in ENA and wBETH and $88.5 million in RLUSD to new addresses.