Binance Hacker Falls Into His Own Trap
The Binance hacker fell into his own trap: a wallet linked by blockchain analysts to the multibillion-dollar exchange hack swapped tokens with an estimated value of $5 million and received just $71 in return. No sophisticated exploit, no new cyberattack, and no elaborate scam. All it took was a single transaction through a nearly empty Uniswap V2 liquidity pool. The entire operation is recorded on the Ethereum blockchain, allowing anyone to examine what happened.
$5 Million Exchanged for Just $71
On October 31, 2026, blockchain analytics platform Lookonchain reported an extraordinarily costly mistake involving an address it associated with the Binance hack.
The wallet holder exchanged 908,793 PROM tokens for Ethereum through the decentralized exchange Uniswap V2.
The result was almost unbelievable:
- 908,793 PROM — the number of tokens exchanged.
- Approximately $5,000,000 — their estimated market value.
- 0.0316 ETH — the amount actually received.
- Around $71 — the dollar value of the received ETH.
The difference between the estimated value of the tokens and the amount received was approximately 99.9986%.
Technically, the transaction was successful. The smart contract executed the swap, the assets moved, and the transaction became a permanent part of the blockchain.
However, the $5 million figure represents an estimated market valuation, not an amount the tokens could necessarily have been sold for.
Following the Transaction: Where Did the Millions Go?
The most interesting part of this story is that the operation can be examined independently.
Unlike many cryptocurrency hacking reports that rely entirely on statements from analysts or anonymous sources, this case includes a specific Ethereum transaction.
Transaction on Etherscan:
https://etherscan.io/tx/0x38546f9087ba0eb8444965711eb64a89fe9f53e80cd6d416317c847308219164
The blockchain explorer allows readers to examine the initiating address, the smart contracts involved, and the movements of the tokens.
According to Lookonchain’s analysis, the operation followed this sequence:
Wallet allegedly linked to the Binance hacker → 908,793 PROM → Uniswap V2 liquidity pool → 0.0316 ETH.
To investigate the transaction, open the link and examine the From, Interacted With, and Token Transfers sections. These provide access to the relevant addresses and their transaction histories.
One important distinction remains: the wallet’s connection to the Binance attack is based on Lookonchain’s attribution. The transaction itself does not establish the identity of its owner.
Why Did Uniswap Allow Such a Terrible Trade?
The problem was an almost complete lack of liquidity in the selected trading pool.
On centralized exchanges, trades are generally executed against buy and sell orders placed by other market participants.
Uniswap V2 operates differently. It uses an automated market maker that calculates swap prices based on the quantities of two assets held in a liquidity pool.
Imagine owning one million tokens, each supposedly worth five dollars. Your wallet displays a balance of $5 million.
There is just one problem: the market where you decide to sell them has almost no available buyers or funds.
As a result, selling the entire position at the displayed valuation becomes impossible.
On Uniswap, this happens automatically. When a massive quantity of tokens enters a pool containing very little ETH, the execution price deteriorates dramatically.
This phenomenon is known as price slippage.
According to blockchain analysts, that is precisely what happened during the PROM swap.
The distinction is essential: an asset’s quoted market value is not necessarily the amount its owner can obtain by selling it.
Even tokens supposedly worth millions can become nearly impossible to liquidate when market depth disappears.
And This Wasn’t the First Mistake
The PROM incident was not the only unusual transaction involving assets that analysts have linked to the Binance hack.
On October 30, Lookonchain reported another incident. According to its findings, tokens with an estimated combined value of approximately $3.32 million were mistakenly transferred to the NEWT smart contract address.
The problem is that sending tokens to a smart contract does not guarantee they can be recovered.
If the contract does not include a mechanism for returning such assets, the funds may become permanently inaccessible.
Within a short period, analysts identified two unsuccessful operations involving assets with a combined estimated value exceeding $8 million.
However, it would be misleading to claim that the attackers necessarily lost $8 million in liquid funds.
Some of those figures reflect quoted token valuations rather than amounts that could realistically have been obtained through market sales.
While Some Millions Disappear, Others Keep Moving
Despite these mistakes, transactions involving assets allegedly connected to the Binance attack have continued.
According to a November 1 report from Lookonchain, the monitored addresses swapped more than 130 different altcoins across EVM-compatible networks.
The operations reportedly produced approximately 123,400 ETH, valued at $277.26 million, along with roughly $1.69 million in USDC.
The combined estimated value of the received assets was approximately $279 million.
These figures do not represent the entire amount stolen. They cover only a portion of the transactions identified and tracked by blockchain analysts.
Meanwhile, law enforcement agencies continue investigating the multibillion-dollar Binance hack. The FBI has attributed the attack to the North Korean hacking group TraderTraitor.
Even advanced blockchain tracing capabilities do not guarantee that stolen assets can be recovered.
Funds may travel through numerous wallets, be exchanged for other tokens, and move between different blockchain networks.
The Crypto Market Doesn’t Forgive Mistakes
There is something deeply ironic about this situation.
The alleged attackers are associated with the theft of billions of dollars, complex cryptocurrency transfers, and networks of wallets designed to move stolen assets.
Yet an enormous amount of estimated token value can disappear through a basic trading mistake.
No smart contract vulnerability was required. Nobody needed to hack the wallet or trick its owner.
Sending a huge quantity of tokens into a liquidity pool with almost no available ETH was enough.
And that is why this story should matter not only to cybersecurity specialists but also to ordinary cryptocurrency holders.
A blockchain does not determine whether a transaction is financially sensible.
A smart contract executes its programmed rules as long as the transaction satisfies the required conditions.
That makes it essential to check available liquidity, expected execution prices, and acceptable slippage before conducting large cryptocurrency swaps.
You can steal billions in cryptocurrency. But that doesn’t mean you know how to handle even a single million.
Sometimes, one transaction is all it takes to prove the point.
Sources
- Lookonchain — Report on the PROM Swap
- Etherscan — Transaction Involving 908,793 PROM
- Lookonchain — Blockchain Asset Tracking Updates
- COINOTAG — Details of the PROM Swap and NEWT Incident