Mentioned in This Article
1. What happened in the PROM sale?
A wallet linked to the Binance hacker sold 908,793 PROM tokens into a Uniswap V2 pool around October 31, 2026, and received only 0.0316 ETH in return, roughly $71. Before the trade, those tokens carried a paper value of about $5 million. The pool on the other side held almost no ether, so the swap converted a multimillion-dollar balance into pocket change.
The transaction is a small footnote next to the scale of the theft itself, but it shows how hard it can be to turn stolen crypto into usable money. Holding a large number of tokens and being able to sell them at a fair price are two very different things, and this trade landed squarely on the wrong side of that gap.
2. Why did a $5 million trade return only $71?
The answer lies in how Uniswap V2 sets prices. Each pool holds two assets, here PROM and ETH, and quotes a price from the ratio between them. There is no order book and no market maker standing by. Anyone who sells one asset into the pool takes the other asset out, and the price shifts along a fixed formula as the balance changes.
When a pool is deep, a large sale moves the ratio only slightly. When it is shallow, the same sale can overwhelm it. In this case the pool contained very little ETH, so there was almost nothing available to pay out. Every additional PROM token pushed the price lower, and the final tokens were effectively sold at a fraction of the starting quote.
Uniswap V2 uses what is known as a constant-product design. The pool tries to keep the product of its two reserves steady, so removing a large share of one asset forces the price of that asset to rise sharply, while adding a large amount of the other pushes its price down. A simplified example shows the effect: if a pool holds only a trivial amount of ETH, a seller who adds a huge quantity of tokens can drain nearly all of the ETH while the token price collapses toward zero. The seller never receives more ETH than the pool contains, no matter how many tokens are offered.
That gap between the price a trader expects and the price the trade actually achieves is called slippage. Here it was extreme: the wallet recovered roughly $14 for every $1 million of nominal value. A quoted price, in other words, describes only the smallest possible trade. It says nothing about how much can be sold at that level.
This is also why a pool's displayed price can be misleading. A token may show a valuation of several dollars per unit because of a handful of tiny earlier trades, even though the reserves behind it are negligible. Once someone attempts to sell a meaningful quantity, the formula takes over and the real value emerges. Traders usually guard against this by setting a slippage tolerance, which cancels a swap if the final price strays too far from the quote. Whether the wallet in this case applied such a limit is not known, but the outcome shows that the trade went through at an extreme discount.
3. How does the sale fit the wider Binance breach?
The PROM dump is one thread in a much larger effort to move stolen funds. The Binance breach took place on October 29, 2026, and reportedly drained about $6.3 billion from the exchange's hot wallets, which are the internet-connected wallets used to process everyday withdrawals.
Hot wallets are a standard feature of centralized exchanges. They hold the funds needed to honor withdrawals promptly, in contrast with cold storage, where the bulk of customer assets is kept offline. A breach of hot wallets is serious because the assets are immediately movable, and attackers can send them across multiple networks within minutes. That speed is part of why the thieves are now working through so many different tokens and chains.
Since then, the person or group behind the theft has been trying to liquidate holdings across several blockchains. Doing so is not simple. Large balances in major assets such as bitcoin or ether can be moved and swapped, but they draw attention and are easier to trace and freeze. Smaller tokens with thin trading can look like a way around that scrutiny, yet they offer too little buying demand to absorb a large sale without wrecking the price.
The FBI has linked the breach to a North Korean-affiliated group. Attribution of that kind matters because it frames the thieves as a state-connected operation with strong incentives to convert stolen assets into funds it can spend, rather than as opportunistic individuals who might simply hold the coins.
For investigators, the pattern of conversions is informative. Each swap, bridge transfer and deposit leaves a permanent public record, and analytics firms follow the flows to alert exchanges and token issuers. Venues that receive flagged funds can refuse deposits, and issuers of certain assets can freeze balances. The hacker therefore has a narrow set of options: use decentralized pools that cannot block a trade, accept steep price impact, or hold assets and wait.
4. Was this the first costly mistake by the wallet?
It was not. Days earlier, the same wallet reportedly sent tokens worth about $3.3 million to $3.5 million to a contract address that can no longer be accessed. Funds sent to a dead contract are, for practical purposes, gone, so that transfer destroyed value just as the PROM sale did.
Two losses in a short period suggest a hurried operation. Moving assets quickly can lower the chance that they are frozen by exchanges or issuers, but speed raises the risk of errors such as picking an illiquid venue or pasting the wrong destination address. On a public blockchain, those errors are permanent and visible to everyone watching.
There is also a structural reason that illiquid tokens attract attention from thieves. Large, well-known assets are closely monitored, and moving them through major platforms is likely to trigger alerts. Lesser-known tokens with open pools can appear to be an easier path, because anyone can swap into them without approval. The trade-off is that their pools are small. A sale far larger than the pool can handle will crush the price, which is exactly what happened to the PROM position.
5. How is Binance responding?
Binance has begun a phased resumption of withdrawals after the breach and has said it will cover user losses from its reserves. The restart is being carried out in stages rather than all at once, a common approach after a security incident, because it lets an exchange confirm that its systems and wallets are behaving as expected before reopening every route.
The commitment to make users whole is aimed at limiting damage to customers, who are usually the most exposed party in an exchange hack. The size of the reported theft makes that promise a heavy one, and it is the reason the recovery of any portion of the stolen assets, or the destruction of value by the thieves themselves, draws close attention.
Customers of exchanges generally care about three things after an incident of this kind: whether their balances are safe, when they can withdraw, and whether the platform can absorb the loss. A staged reopening speaks to the second point, while the pledge to draw on reserves speaks to the first and third. How quickly full service returns will depend on how comfortable the exchange is with its security controls and wallet infrastructure after the breach.
6. What does the episode teach DEX traders?
For anyone trading on decentralized exchanges, the lesson is about liquidity. A token's headline price is only meaningful if enough capital sits in its pool to support the trade size. Before selling a large position, traders typically check how much value the pool holds, how far a sale would move the price, and whether a better route or a split across several trades exists.
The same logic applies in reverse. A balance that looks valuable on a portfolio tracker may be impossible to cash out. Valuations derived from the last traded price can overstate what a holder could really recover, particularly for tokens with little trading activity. The wallet in this story learned that difference at a very high cost.
Retail users of automated market makers can also draw a practical conclusion about risk. Providing liquidity and trading in small pools carries distinct hazards, from sudden price swings to the possibility that a large seller will drain one side of the pool. Understanding how a pool's reserves relate to the price on the screen is a basic part of using these venues safely, and the PROM trade serves as an unusually stark illustration.
7. What does it mean for investigators and exchanges?
For those tracking the stolen funds, each failed conversion is value the attackers cannot launder. Tokens locked in inaccessible contracts, or dumped into shallow pools for almost nothing, shrink the amount that can eventually be turned into cash. Compliance teams at exchanges and analytics firms can also follow these movements to see where the thieves are heading next.
There is a further consequence for the broader market. Tokens that become the target of a forced seller often see their prices fall sharply within a few minutes, and holders of those tokens bear the loss even though they had nothing to do with the original theft. Pool providers who supplied the other side of the trade can end up holding a depleted, near-worthless asset. Such second-order effects are one reason incidents of this size ripple outward beyond the exchange that was attacked.
A hacker under pressure may continue to use thin venues across different chains, which can cause sudden price dislocations in whichever tokens are being sold. Traders holding small-cap assets that appear in flagged wallets should be aware that such sell-offs can arrive without warning and leave little time to react.
Further movements from the wallets tied to the breach are likely to be watched closely in the coming days, as Binance continues restoring withdrawals and analysts keep following the trail of the stolen assets.