Binance hack: the attacker's hub is dumping its token stacks.

Since 04:28 UTC the hub 0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c has sent out 12 stacks. All but PROM went to fresh addresses with ETH for gas, and those addresses sell them. Leaving out INNBC, which has no clear price, the stacks were worth $24.4M at Arkham's prices when they left.

Sold by 09:19 UTC: eight stacks worth $20.0M when sent. PROM went straight into a DEX pool that held 0.03 ETH and fetched 0.03 ETH. ZAMA, SOPH, NIL, RE, BLUR, ROBO and VIRTUAL fetched 4,860 ETH.

Where the ETH went: from 08:40 to 08:47 UTC five sellers sent 2,815.96 ETH to 0xC2096a12eBE0944f4d39E59979F485AfD92d850a. It held 3,000 ETH before and has 5,815.96 ETH at 09:19 UTC. The NIL seller still holds 861.48 ETH. The VIRTUAL seller still holds 1,182.68 ETH on Base.

Still unsold at 09:19 UTC, about $4.2M at current prices:
LSK 9,258,136 on 0x2274F5057f331d4939492b03F3c0001B27fB64b0
FUN 564.1M (97.1% of the stack) on 0xFB34f34A0A395Afb3D5094816Aa235483f0C2095
ZKP 9,205,750 (92.5% of the stack) on 0x09c9BDb15c8CE62CC875DE32F6A48A419E389dd6
INNBC 250.8T on 0x2c1396D6b0803E0B55b23F877FcF57F4F77171A2, no clear price, not counted

The ETH raised plus the unsold tokens are worth 62% of what the stacks were worth when they left the hub.

Follow for updates on the Binance trace.