Binance hacker loses another $5 million on PROM tokens after $6.3 billion theft

The attacker behind the record-breaking $6.3 billion Binance hack has hit another expensive snag: a failed attempt to sell nearly $5 million worth of PROM tokens left them with just $71. For high-risk operators, the detail that matters is not the meme-worthy loss, but the liquidity mechanics that turn stolen assets into a traceable mess.

1. According to blockchain analytics platform Lookonchain, the hacker sold 908,793 PROM tokens on Uniswap V2 but received only 0.0316 Ethereum (ETH), worth approximately $71 at the time. The $5 million figure reflects the tokens’ estimated market value, not what could actually be realized in that pool.
2. The issue was liquidity, or rather the lack of it. Uniswap V2 uses liquidity pools to facilitate trading, and when someone dumps a large position into a shallow pool, slippage and price impact can be brutal. In practice, the market value on paper and the executable price are two very different things.
3. This is not the attacker’s first costly mistake while trying to move stolen funds. A separate investigation by blockchain analytics firm Bitquery, published on October 30, estimated that the attacker had incurred approximately $119 million in losses while liquidating the stolen cryptocurrency.
4. Bitquery broke that $119 million down into $71.5 million from buying Ethereum above prevailing market prices, $24.8 million from selling stolen tokens below market value, and another $22.4 million from unfavorable TRON (TRX) purchases. The firm said the attacker converted hundreds of millions of dollars in stolen stablecoins into ETH and TRX through decentralized exchanges and other trading services.
5. The liquidation problems came after one of the largest cryptocurrency thefts on record. Approximately $6.3 billion was stolen from Binance on October 29, when the attacker drained 17 Binance hot wallets across nine blockchain networks between 20:04 and 23:56 UTC by exploiting compromised withdrawal infrastructure to authorize unauthorized transfers.

Binance’s investigation pointed to a compromised DevOps engineer’s laptop, which may have exposed an internal withdrawal-processing service. At the same time, the Federal Bureau of Investigation (FBI) attributed the attack to TraderTraitor, a North Korean state-sponsored hacking group, and said the attackers were converting stolen assets primarily into Ethereum, potentially using decentralized finance platforms and instant swaps to launder the proceeds. Binance said it had recovered or covered approximately 95% of the stolen assets in its November 1 update and would gradually resume withdrawals, starting with major cryptocurrencies.