Binance Hacker's $5 Million PROM Sale Fetches Just $71 in ETH

$5 Million of PROM for $71 in ETH

The Binance hack cash-out has logged its most expensive mistake yet, observed on-chain on October 31: an estimated $5 million of PROM sold into a nearly empty liquidity pool for roughly $71 in Ethereum (ETH). The transaction record on Etherscan shows the swap executed at 04:28 UTC (12:28 Taipei time), routing 908,793 PROM through the router of Uniswap V2, a DeFi protocol, into the PROM/ETH spot trading pair. The trade settled on-chain without error, and the tokens cannot be recalled. Anyone can verify the transfer; our guide on how to read the Ethereum blockchain explains records like this one. The attacker, reported to have stolen about $6.3 billion from Binance, has been selling tokens and moving funds continuously since the breach.

The pricing mechanics did the damage. A decentralized exchange pool values each trade by the ratio of its two tokens, so once almost all ETH had left the pair, even a very large altcoin position could collect only the dust that remained. On-chain data reported on November 1 values the PROM at about $5 million and the return at 0.0316 Ethereum (ETH), or roughly $71, with the pool described as effectively drained at the time of the swap. That sale is the latest reading in a running tally rather than a final one. By the morning of October 30, on-chain tracking showed the attacker had fully exited UNI, ENA, PEPE, LINK, AAVE, ONDO and WLD, converting the proceeds into 70,480 ETH, an estimated $158 million. The FBI formally attributed the hack to North Korea on November 1 and stated in its announcement that the stolen assets have been converted mainly into ETH. Nearly all of the observed disposal volume has therefore landed on the Ethereum blockchain as ETH, leaving the PROM trade a failed exception: a $5 million position reduced to about $71 of its destination asset.

18 Tokens Locked in the NEWT Contract

An earlier slip, on the evening of October 30, was larger in absolute terms. The attacker sent roughly 8 million NEWT together with 17 other tokens, 18 in all, to the NEWT token's own smart contract address. At the prices of that moment the bundle was estimated at about $3.5 million, with a separate on-chain estimate putting it closer to $3.32 million.

The Newton Foundation, which issues NEWT, published a statement on the incident confirming the transfer and setting out why the funds cannot come back. Its post-mortem states that the NEWT contract was not breached: the contract has no owner and no administrator, its upgrade function has been permanently disabled, and the tokens sent to it are now permanently locked, with no withdrawal path for anyone. The foundation said it has passed its findings to Binance. Additional on-chain analysis noted that the foundation relinquished the contract's admin rights in 2025, which is what leaves the misplaced deposits unrecoverable.

Around these two errors, the wider laundering operation has run at a pace that on-chain researchers describe as automated. Elliptic observed on October 31 that the attacker's main distribution wallet on Tron paid out every hour for 31 consecutive hours, with the longest pause lasting 46 minutes. The same deposit amount reached the cross-chain protocol THORChain 19 times, and when a bridge rejected a deposit the funds were automatically resent from a fresh wallet, a schedule Elliptic reads as programmed. Chainalysis separately reported what it called an unprecedented automated laundering pattern, thousands of transactions cycling funds across addresses within short windows. The pattern fits the wider enforcement backdrop of recent US sanctions against North Korean crypto cash-outs.

What the On-Chain Record Settles

COINOTAG's reading is that the two failures show exactly where programmatic laundering breaks. An automated market maker pool punishes any sell sized against thin liquidity, and the PROM swap is verifiable in a single transaction that cannot be unwound. The NEWT loss has a documented root cause, an ownerless contract with its upgrade function disabled since 2025, confirmed by the issuer's own post-mortem rather than by inference. As of November 1, the observed tally stands at 70,480 Ethereum (ETH) converted by October 30 plus roughly $8.5 million erased in the two blunders, while the final destination of the rest of the estimated $6.3 billion haul remains uncounted.