Binance hacker dumps a little-known 2017 token and it crashes 90%

Updated Oct 30, 2026, 7:23 a.m. EDT. Published Oct 30, 2026, 3:54 a.m. EDT.

4 min read

FUN token crashes as hacker sells into a tiny pool. (Gecko terminal)

Summary

FUN plunged more than 90% in a Uniswap trading pool after Binance hacker began selling smaller coins.
The attacker sold 134.1 million FUN and several other smaller tokens, overwhelming a small liquidity pool where limited funds made prices especially vulnerable to selling.
The selling wallet still holds 580.8 million FUN, about 5.4% of the token’s maximum supply, leaving the market exposed to further sales despite a partial price rebound.

An obscure cryptocurrency introduced during 2017 plummeted in value by over 90% early Friday after the Binance attacker offloaded it into a market far too shallow to handle the transactions.

FUNToken (FUN), previously designated as FunFair, dropped more than 90% within the specific Uniswap liquidity pool utilized by the hacker, sliding from approximately 0.0000037 wrapped ether (WETH) down to 0.00000017 WETH, according to GeckoTerminal metrics.

Its valuation in fiat experienced a parallel collapse. Across all trading venues, FUN has dropped 68% over a 24-hour period, CoinGecko figures indicate. Uniswap operates as a decentralized trading platform enabling direct asset swaps against communal pools rather than relying on a centralized order book managed by a company.

FUN traces its origins back to the 2017 crypto bull run. Its creator, FunFair Technologies, secured $26 million in four hours via an initial token offering that July aimed at developing blockchain-driven online casino software. The initiative presently functions under the name FUNToken.

This sudden depreciation stems from the Binance security breach, where the intruder drained upwards of $6 billion from the exchange’s hot wallets—the internet-linked reserves utilized for processing user withdrawals. This establishes the incident as the largest digital asset heist in history.

The stolen cache contained major holdings including tether USDT, USD Coin USDC, bitcoin BTC, ether ETH, TRON TRX, and solana (SOL), per Arkham Intelligence. Furthermore, it encompassed lower-cap assets such as FUN, Prom (PROM), Reserve Rights (RSR), RedStone (RED), Origin Protocol (OGN), and Gitcoin (GTC), based on research by The Tie Co-founder and CEO Joshua Frank.

Stablecoin administrators Tether and Circle acted swiftly to freeze the compromised coins under their authority, with several alternative issuers adopting similar measures. FUNToken urged centralized platforms to suspend FUN deposits as a safety precaution.

Nevertheless, trading activity on decentralized networks like Uniswap cannot be blocked, providing an open avenue that the hacker exploited.

Hacker liquidates FUN

At 23:28 UTC on Thursday, an address designated by Etherscan as Binance Hot Wallet Exploiter 2 transferred 714.9 million FUN to a newly created address, 0x06ea…685f. Three minutes later, that receiving wallet commenced liquidations into the FUN/WETH liquidity pool hosted on decentralized exchange Uniswap.

The account executed in excess of 150 transactions throughout the following hours, with all but one directed at the Uniswap v2 FUN/WETH pool. WETH represents a tokenized iteration of ether. The remaining trade was routed through PancakeSwap, an alternative decentralized platform. The final transaction occurred at 04:17 UTC on Friday.

In total, the address unloaded 134.1 million FUN in exchange for 111.5 ETH, valued at roughly $250,000, according to Etherscan records.

Calculated against Frank’s earlier estimated valuation of $6.23 million for the stolen FUN cache, these specific coins possessed a theoretical book value of approximately $1.17 million—meaning the attacker realized only about 21% of their nominal worth.

Tiny pool

The pool is exceptionally small, maintaining an aggregate value of around $16,000 as of this writing, divided equally between FUN and WETH. Consequently, even modest sell orders can drastically depress prices.

A Uniswap pool functions analogously to a shared reservoir containing two assets, in this instance FUN and WETH. There are no standing bids waiting at predetermined price points. A vendor deposits FUN into the reserve and withdraws WETH, causing the exchange rate to shift dynamically based on the updated asset proportions. The smaller the reservoir, the more severely every trade skews that ratio and drives down the valuation.

Certain analysts had previously highlighted the danger of severe price collapses concerning these lower-capitalization tokens. Within an X thread, Frank contrasted the hacker’s holdings against each asset’s typical daily trade volume. The attacker’s FUN balance was valued at $6.23 million at the time, representing 252% of the token’s daily turnover, placing it at the summit of his index ahead of PROM.

“The hacker holds more than an entire day’s reported trading volume in FUN and PROM,” Frank noted.

He pointed out that trading volume serves merely as an approximate indicator of potential downside risk.

Based on the valuation implied by Frank’s prior $6.23 million assessment of the stolen FUN assets, those 134.1 million tokens were notionally worth approximately $1.17 million. The perpetrator secured only $250,000, or roughly 21% of that worth. Since trading activity ceased, purchasers have stepped in, driving the pool price up by 75% over the past hour. The liquidating wallet continues to retain 580.8 million FUN, accounting for roughly 5.4% of the asset’s maximum circulation limit, per Etherscan. That reserve could re-enter the open market at any moment.

Alternative minor tokens offloaded by the perpetrator have also experienced declines, albeit less severe ones. Reserve Rights (RSR) is down 17.6% over a 24-hour window.

RedStone (RED), a decentralized oracle network, has dropped 17.1%. Gitcoin (GTC), the governance asset for a public-goods funding ecosystem, has fallen 16.6%. Origin Protocol (OGN), yearn.finance YFI, and 1inch (1INCH) have retreated between 9% and 13.6%, CoinGecko data indicate. By comparison, bitcoin and ether registered losses of 1.8% and 2.9%, respectively.

Etherscan records indicate that the primary hacker address, 0x5227…2f8c, disposed of each of those assets across numerous transactions on Uniswap and PancakeSwap.

“My biggest watchlist from the wallet is FUN, PROM, RSR, RED, OGN, SOPH, ERA and GTC. The interesting question isn’t just how much was stolen. It’s how much remains transferable, how quickly the hacker can liquidate it, and which markets have enough liquidity to absorb those sales,” Frank wrote.