Kucoin's $150M Hot Wallet Breach Sends Laundered Funds Through Uniswap and Binance

Kucoin has told users that every asset taken in what it initially called an "unplanned movement of funds" on September 26 will be made whole, citing insurance coverage for the incident. The exchange's original estimate put the loss at a minimum of $150 million, though outside observers have suggested the real figure could run as high as $280 million as additional linked wallets come to light.

In the day following the breach, the attacker began cashing out through Binance and Uniswap, converting the stolen tokens into ETH. OCEAN and SNX were among the first assets liquidated, and the size of the sales was large enough to noticeably depress both tokens' prices — OCEAN sales were recorded on Etherscan around Sep-27-2020 06:54:55 AM UTC, with SNX sales following around Sep-27-2020 12:52:25 PM UTC, both visible in seven-day price charts showing the impact.

COMP, LINK, and DIA were sold off as well. With the wallet's full holdings publicly visible, uncertainty has spread among holders of the roughly 160 remaining token types still sitting in the address. Tracing tool Breadcrumbs mapped the flow of funds from Kucoin into the attacker's wallet, showing the money moving through Uniswap before consolidating into two addresses:

0x00600423c03ec4b46f9b8a28c66d42bdd1b19c36

0xf519e276958c3ef2dffd9b6b2d87d26859526505

Among the earliest funds moved out was a comparatively modest 50,000 USDT, shortly after which Tether froze the remaining balance in the wallet — a response many considered predictable, leading some to question why that token wasn't moved first if avoiding a freeze was a priority.

Several projects took independent action to blunt the damage by forking, freezing, or blacklisting the stolen tokens. Estimated stolen amounts per project include:

• Velo — roughly $76 million
• Tether — roughly $22 million
• Orion — roughly $10 million
• KardiaChain — roughly $10 million
• Ocean Protocol — roughly $9 million
• Ampleforth — $9 million
• VIDT Datalink — roughly $7 million
• NOIA Network — roughly $5 million
• Aleph — $1.2 million
• Covesting — roughly $600,000
• Opacity — $215,000
• SilentNotary — $99,000

While this response protects the holders of the affected tokens, it also highlights how centralized control still sits behind protocols that market themselves as decentralized.

The attacker managed to pull $150 million in ERC20 tokens out of the exchange, yet the laundering methods used afterward were fairly unsophisticated — enough that some have floated the possibility of inside involvement, since the breach appears to have relied on access to the hot wallet's private key rather than a brute-force intrusion.

Commentary also emerged suggesting the attacker would have laundered funds more effectively through DeFi venues like Curve or Balancer; Curve pushed back on this, arguing that decentralized protocols are actually less useful for laundering than centralized alternatives.

The breach wasn't limited to Ethereum-based assets — 1,008 BTC were also stolen. Using the Bitcoin network, the attacker embedded a message aimed at the community directly in a transaction: "Epic Hack Homie - Not your keys not your coins."

The crypto community has continued to react to the attacker's known address, and the story remains open as more details emerge.