Binance hack: this morning the attacker opened two new exits.
1. NEAR. The 12.41M NEAR account from our Oct 31 post started moving at 02:29 UTC. By 08:59 UTC about 109,300 NEAR, roughly $0.48M, had left it. Fan-out wallets split it into pieces of 1,000 to 11,000 NEAR, and each piece goes within seconds to bridge-mng.near, which deposits into the HOT bridge and NEAR Intents. At least 41,000 NEAR has gone in so far. 12.30M NEAR is still on the account.
2. Lighter. Parked ETH was swapped to USDC on CoW and sent through the Relay bridge to the Lighter perp exchange: 219,846 USDC to three accounts between 06:53 and 07:10 UTC. Each account was empty again within minutes.
We have warned HOT Labs and Lighter.
1. NEAR. The 12.41M NEAR account from our Oct 31 post started moving at 02:29 UTC. By 08:59 UTC about 109,300 NEAR, roughly $0.48M, had left it. Fan-out wallets split it into pieces of 1,000 to 11,000 NEAR, and each piece goes within seconds to bridge-mng.near, which deposits into the HOT bridge and NEAR Intents. At least 41,000 NEAR has gone in so far. 12.30M NEAR is still on the account.
2. Lighter. Parked ETH was swapped to USDC on CoW and sent through the Relay bridge to the Lighter perp exchange: 219,846 USDC to three accounts between 06:53 and 07:10 UTC. Each account was empty again within minutes.
We have warned HOT Labs and Lighter.
