Binance Hack-Linked Attacker Sells 7 Altcoins on Oct. 29
Key Facts
The attacker linked to the Binance hack sold seven altcoins on Oct. 29, according to data cited by Bloomingbit from Lookonchain, including UNI, ENA, PEPE, LINK, AAVE, ONDO and WLD. Binance published its official incident update on Oct. 30, a different date from the token sales. The platform estimated the incident’s total impact at about $6.3 billion in its update. It said it had frozen about $3 billion in on-chain assets.
UNI and ENA led the sales by value: 7.02 million UNI were sold for $39.63 million, and 217.5 million ENA for $33.93 million, according to Lookonchain as cited by Bloomingbit. Sales of 7.77 trillion PEPE generated about $31.66 million, while 2.57 million LINK brought in about $26.05 million. The attacker also sold 127,953 AAVE for $14.27 million. Sales also included 21.85 million ONDO worth $6.62 million and 17.32 million WLD worth $6.09 million. These amounts show the scale of the sell-off across tokens linked to different sectors of the digital-asset market.
According to a LlamaRisk report published on the Aave governance forum, the attacker’s address received 167,464 ETH from a Binance hot wallet on the Ethereum network at 20:24 UTC on Oct. 29. The address then received 28,006 ETH from a second hot wallet belonging to the platform. The funds were subsequently distributed across more than 20 new wallets. These transfers place the token sales in the context of broader asset movements linked to the incident. Binance said its initial investigation indicated that a DevOps engineer’s laptop may have allowed the attacker to access a service container and submit unauthorized withdrawals, adding that it had found no evidence of private-key leaks from the wallets.
The impact of the movements extended to the Aave protocol. The LlamaRisk report said the market freeze covered 175 reserves in Aave V3 across 16 networks and 117 reserves in Aave V4 across four networks. The report said the attacker’s position on the platform comprised $59.9 million in USDT collateral against $43.8 million in debt, describing it as overcollateralized and subject to normal liquidation. Aave said it would monitor the attacker’s wallets and price feeds, and keep markets frozen until the funds stopped moving and Binance’s containment measures became clear. It added that it would then work with Aave Labs and service providers to gradually unfreeze markets. The breadth of the freeze reflects the incident response’s reach across lending markets on multiple networks.
In market moves, the LlamaRisk report said ETH and BTC had fallen about 4% from the time of the withdrawal through 00:55 UTC on Oct. 30. AAVE and LINK had each fallen about 9%, while UNI was down about 8%, according to the report. In early Asian trading on Friday, bitcoin fell about 2% to $77,646, its lowest level in six weeks, and ether fell about 2% to $2,238.76, its lowest in two months. BNB also dropped more than 8% in 24 hours to $694, according to Reuters via Investing.com. Binance said users would not bear losses from the hack and that the company would cover them through its SAFU fund and its own funds.
Binance said it would publish a detailed technical review after the investigation was complete and the facts had been fully verified. It also plans to issue an updated proof of reserves after remediation is complete. The platform tied the incident’s total impact estimate to about $6.3 billion and said it had so far frozen about $3 billion on-chain. Aave, meanwhile, said markets would be unfrozen in stages after the attacker’s funds stopped moving and containment measures became clear. The forthcoming technical review remains Binance’s next announced step on the incident’s details. The platform also said the facts would be verified before it published its report.