Binance Hack Puts DeFi on Alert as $5.5 Billion in Stolen Assets Raises Contagion Risk

A hacker tied to the Binance breach is converting stolen assets into Ether to evade asset freezes. The attacker has gone beyond direct stablecoin swaps, also posting them as collateral to borrow Ether. Decentralized finance, or DeFi, protocols have begun restricting lending markets to block further fund movements.

Assets believed to have been drained from wallets linked to Binance total at least $5.5 billion, Decrypt reported on October 29. The attacker has been using decentralized exchanges including Uniswap to swap stablecoins for Ether.

The push to convert assets stems from the freeze functions built into stablecoins. Tether and Circle can block suspicious addresses and halt the movement of USDT and USDC. The two companies have frozen more than $2 billion tied to the incident. Ether, by contrast, has no central issuer that can freeze assets at specific addresses in the same way.

Transactions also showed the attacker using lending protocols as a workaround. One wallet tied to the attacker deposited $60 million of USDT on Aave as collateral and then borrowed about 19,762 Ether. That let the attacker obtain an asset that is harder to freeze without selling the stablecoins outright.

The activity has fueled concern that the risk could spread to DeFi lending markets. If stablecoins posted as collateral are frozen, lending protocols could face disruption when trying to liquidate that collateral. Odysseas Lampridis, founder of Phylax Systems, said contagion is spreading across DeFi.

Aave has since moved to block additional borrowing by restricting new deposits and loans. Kamino, a Solana-based lending protocol, also temporarily suspended lending in Solana- and Bitcoin-related markets as a precaution.

Ripple's dollar-pegged stablecoin RLUSD was also used to move funds. The attacker is believed to have swapped about $36 million worth into Ether. Binance co-Chief Executive Officer He Yi said the Ripple team helped freeze about $200 million in assets and that user funds are safe.

Jack McDonald, Ripple's senior vice president for stablecoins, said the company is actively freezing affected assets and will cooperate on measures to protect users.