The attacker behind the record-breaking $6.3 billion Binance hack has suffered another costly setback after attempting to sell nearly $5 million worth of PROM tokens.
According to blockchain analytics platform Lookonchain, the hacker sold 908,793 PROM tokens on Uniswap V2 but received just 0.0316 Ethereum (ETH), worth approximately $71 at the time.
Notably, Uniswap V2 relies on liquidity pools to facilitate trading, but selling large quantities into shallow pools can trigger extreme slippage and price impact.
Advertisement
In this case, the PROM pool lacked sufficient liquidity, leaving the hacker with just $71. The $5 million figure reflects the tokens’ estimated market value, not their realizable sale value.
Costly mistakes to launder money
The transaction adds to a growing list of costly mistakes as the attacker attempts to convert the stolen assets into other cryptocurrencies.
For instance, a separate investigation by blockchain analytics firm Bitquery, published on October 30, estimated that the attacker had incurred approximately $119 million in losses while liquidating the stolen cryptocurrency.
These included $71.5 million from buying Ethereum above prevailing market prices, $24.8 million from selling stolen tokens below market value and another $22.4 million from unfavorable TRON (TRX) purchases.
Bitquery found that the attacker converted hundreds of millions of dollars in stolen stablecoins into ETH and TRX through decentralized exchanges and other trading services. Some transactions involved substantial price premiums, suggesting the hacker prioritized moving funds quickly over securing favorable exchange rates.
The distorted prices also created opportunities for arbitrage traders and automated trading bots to exploit price differences across platforms and liquidity pools.
Advertisement
The liquidation problems follow one of the largest cryptocurrency thefts on record, with approximately $6.3 billion stolen from Binance on October 29. The attacker drained 17 Binance hot wallets across nine blockchain networks between 20:04 and 23:56 UTC, exploiting compromised withdrawal infrastructure to authorize unauthorized transfers.
Binance’s investigation pointed to a compromised DevOps engineer’s laptop, which may have exposed an internal withdrawal-processing service.
FBI links hack to North Korea
At the same time, the Federal Bureau of Investigation (FBI) attributed the attack to TraderTraitor, a North Korean state-sponsored hacking group. The agency said the attackers were converting stolen assets primarily into Ethereum, potentially using decentralized finance platforms and instant swaps to launder the proceeds.
Binance pledged to cover affected customer balances and work with law enforcement and industry partners to recover the funds.
In its November 1 update, the exchange said it had recovered or covered approximately 95% of the stolen assets and would gradually resume withdrawals, starting with major cryptocurrencies including Bitcoin (BTC), Ethereum, BNB, Solana (SOL), XRP and Dogecoin (DOGE).
The remaining 5% comprised less-liquid assets that could take longer to replace. Binance’s commitment does not mean the attacker returned the funds, but it ensures customers are shielded from the losses.
Featured image via Shutterstock
