The Binance hack attacker has sold seven altcoins for a combined $158.25 million and converted the proceeds into 70,480 ETH, according to on-chain analytics firm Lookonchain, leaving about $23 million of altcoins in wallets that issuers cannot touch.
That leaves a Binance hack balance sheet of roughly $2.86 billion still under the attacker’s control, against about $2.69 billion frozen by Tether, Circle, Ripple, World Liberty Financial and the Arbitrum Security Council. The freeze caught the stablecoins. Everything else has been moving.
The Binance Hack Attacker Sold Seven Tokens and Bought Ether With All of It
Lookonchain’s tally gives an execution price for every one of the seven positions. UNI raised the most, 7.02 million tokens at $5.65 for $39.63 million, followed by 217.5 million ENA at $0.16 for $33.93 million and 7.77 trillion PEPE at $0.0000041 for $31.66 million. Then came 2.57 million LINK at $10.14 for $26.05 million and 127,953 AAVE at $111.55 for $14.27 million. The last two were 21.85 million ONDO at $0.30 for $6.62 million and 17.32 million WLD at $0.35 for $6.09 million.
Legendary trader dimethyltryptamine.eth, who once spent just 0.125 $ETH ($251) to buy 5.9T $PEPE ($100M at peak), bought another 45.08B $PEPE ($206.5K) after the Binance hacker finished dumping $PEPE.
https://t.co/ft6tMiHVUs https://t.co/fGqAiEkWWA
— Lookonchain (@lookonchain) October 30, 2026
All seven of those sales were settled into the same asset, which is ether. At the implied rate the attacker paid roughly $2,245 an ETH, which sits inside the band ether was trading in during the Binance hack, when it fell from $2,335 to about $2,255 in an hour. Arkham puts the attacker’s ether holding at 495,724 ETH across ten addresses, worth about $1.09 billion. The bitcoin stands at 18,270.2 BTC across 19 addresses, worth about $1.41 billion, and it has not moved since 20:48 UTC on the night of the theft.
The frozen column is almost entirely stablecoins, and the attacker’s column is almost entirely assets no issuer has a freeze function for. Source: TRM Labs, Arkham, Lookonchain · Chart: FinanceFeedsThe Freeze Reached the Stablecoins and the Attacker Reached Everything Else
TRM Labs counted about 1.77 billion USDT frozen by Tether and about 825 million USDC by Circle. Ripple froze 40.5 million of 88.5 million RLUSD and World Liberty Financial 27.8 million USD1. The Arbitrum Security Council added 8,426 ETH and 74.6 million ARB, for a total near $2.7 billion as of 00:30 UTC. Binance has put its own verified figure at about $3 billion.
A freeze only works on a token that has an issuer and a blocklist behind it. Bitcoin, ether, TRX and SOL have neither, which is why the attacker’s remaining position is concentrated in exactly those four. TRM counted more than 420,000 ETH at 00:30 UTC. Arkham’s later count is 495,724, so the position grew by roughly 75,000 ETH while the freeze was being tallied, which is the Binance hack in one number.
Investor Takeaway
The Binance hack attacker now holds about $2.86 billion in assets with no issuer-level freeze function, against about $2.69 billion that has been frozen.
Every Conversion Is a Race, and the Attacker Paid 10% to Win It
The altcoin sale is the third leg of a pattern TRM documented through the night of the Binance hack. About 325 million USDT was sold through UniswapX for roughly 122,300 ETH at about a 10% discount, with the remaining 175 million USDT frozen before it could follow. Another 60 million USDT was supplied to Aave and borrowed against for about 19,760 ETH, after which Aave froze the affected markets. On Tron, funds went into JustLend and through decentralized exchange hops, and about 30 million USDT there was frozen. Of 88.5 million RLUSD, 48 million was sold on decentralized exchanges between 21:42 and 22:01, minutes ahead of Ripple’s freeze.
The 10% discount is the clearest number in the whole episode, because it is what the attacker was willing to pay for speed. The TRX holding tells the same story from the other side. TRM recorded 46.4 million TRX taken from the Tron hot wallet, and the attacker now holds 682.9 million worth $242.59 million, so most of that position was bought with stolen Tron stablecoins before they could be blocked.
A New Wallet Went 3x Long on ENA Minutes After the Last Sale
About 37 minutes after reporting the dump, Lookonchain flagged a newly created wallet, 0xedc0, that deposited 2 million USDC into Hyperliquid and opened a 3x long on 22.78 million ENA worth $4.09 million. That is a position taken on the view that Binance hack selling in ENA is finished.
Set the two prices side by side and the size of the bet becomes legible. The hacker cleared 217.5 million ENA at an average $0.156, and the new long works out at about $0.180 a token, roughly 15% above where the supply was absorbed. Four Binance hack altcoin positions are still unsold: 714.91 million FUN at $6.29 million, 87.85 million ZAMA at $6.02 million, 3.6 million ZRO at $5.69 million and 3.38 billion RSR at $5.02 million.
TRM attributes the Binance hack to North Korea’s TraderTraitor with high confidence, alongside Chainalysis, and expects bridges, swap services and over-the-counter brokers to handle the bitcoin and ether next. Binance has pledged to cover user losses in full and expects withdrawals back within 48 hours of 04:17 UTC.
Investor Takeaway
Only $23 million of altcoins is left, so Binance hack selling pressure on UNI, ENA, PEPE, LINK, AAVE, ONDO and WLD is largely spent, and the overhang moves to the majors.