Binance Hacker Makes Series of Mistakes in Liquidation: Sells $5 Million Worth of PROM Tokens for Just $71 in Ethereum

In the cryptocurrency world (120btc.CoM): After stealing a large amount of assets from a centralized exchange, the attacker made serious operational errors during the high-frequency diversion and liquidation of tokens on-chain. On November 1, the on-chain data analysis platform Lookonchain monitored and pointed out that the hacker's address lacked awareness of the decentralized liquidity depth during the token liquidation process, dumping approximately $5 million worth of PROM tokens into a liquidity pool that was nearly completely drained, ultimately receiving only a minuscule amount of spot assets.

According to the on-chain interaction details traced by Etherscan, this abnormal liquidation occurred at 12:28 PM Beijing time on October 31. The attacker-controlled address called the Uniswap V2 routing contract, directly dumping 908,793 PROM tokens into the PROM/ETH trading pair pool, resulting in only 0.0316 ETH actually received. Based on the fair market price at that time, the normal valuation of this batch of tokens reached $5 million, while the actual Ethereum spot value obtained was only about $71.

From the underlying pricing algorithm of automated market makers (AMM), the available ETH reserves in the liquidity pool had been nearly drained by prior trades. Under the constant product formula constraint, the asset pricing in the pool is strictly determined by the reserve ratios of the two tokens; in an environment where the underlying settlement asset is nearly zero, large sell orders directly breach the price slippage bottom line, causing tokens worth millions of dollars to be swallowed by the system, and due to the irreversible nature of the blockchain state machine, this extreme discount transaction could not be executed on-chain after being packaged and confirmed.

18 Tokens Worth Nearly $3.5 Million Permanently Locked

Before this extreme slippage incident occurred, the hacker's address encountered an even more fatal asset destruction error on the evening of October 30. The issuer of the NEWT token, the Newton Foundation, confirmed that the attacker mistakenly transferred approximately 8 million NEWT and 17 other associated assets directly into the underlying smart contract address of the NEWT token during a cross-address transfer.

Based on the asset spot quotes at that time, the total value of the mistakenly transferred assets was about $3.5 million (Lookonchain's independent valuation was approximately $3.32 million). In response to speculation about contract vulnerabilities, the Newton Foundation publicly clarified that the underlying smart contract of NEWT had not experienced any unauthorized penetration, but due to its architecture being an immutable contract with no administrator, the internal contract upgrade and administrator withdrawal interfaces have been permanently sealed off at the technical level.

On-chain independent analyst Yu Jin further confirmed that the project party had officially announced the abandonment of the contract owner's (Owner) control privileges as early as 2025. This means that the 18 tokens mistakenly stored in the contract address have completely lost the private key control subject, falling into a state of permanent lock at the state level, and no institution, including Binance and the foundation, can retrieve them through technical intervention.

Cross-Chain Diversion Sweeps Over $270 Million

Apart from the two aforementioned local losses caused by script malfunctions, the attacker's large-scale cleaning efforts continue to rapidly converge towards high liquidity assets along the established path. Lookonchain monitoring shows that as of the morning of October 30, the hacker had completely cleared a series of mainstream tokens including UNI, ENA, PEPE, LINK, AAVE, ONDO, and WLD, accumulating 70,480 ETH (equivalent to about $158 million).

By the afternoon of November 1, the cleaning scale further spread to long-tail assets. Statistics indicate that on Ethereum and other EVM-compatible public chains alone, the attacker has concentrated on selling over 130 secondary tokens, accumulating 123,400 ETH (approximately $277 million) and 1.69 million USDC, with the overall cash-out scale reaching $279 million. This liquidation path aligns closely with the FBI's previous qualitative notice that "stolen mixed assets are being systematically consolidated into ETH."

Blockchain security firm Elliptic noted in analyzing the fund cleaning mechanism that the organization's fund transfers exhibit extremely high autonomous driving characteristics:

• Continuous operation of the on-chain pipeline: The hacker's fund distribution address deployed on the Tron network maintained a continuous 31-hour high-frequency withdrawal rhythm, with the longest single pause interval being only 46 minutes;

• Highly programmatic scheduling parameters: The amount of funds initiated for recharge to the decentralized cross-chain protocol THORChain showed highly regular repetition, with completely identical amount parameters mechanically called 19 times;

• Dynamic fault tolerance and adaptive detours: Once a specific cross-chain gateway triggers anti-money laundering risk control and refuses to accept deposits, the automated scheduling script immediately generates a brand new unpolluted wallet to resubmit the funding request.

Chainalysis also confirmed that this hacker organization has adopted a previously rare highly automated money laundering model, orchestrating thousands of on-chain transfers in a very short time and interweaving them among a vast number of intermediary addresses, demonstrating a strong industrialized fund dispersion characteristic.