2017 Crypto Token Loses 90% After Suspected Binance Hacker Offloads Holdings

A little-known cryptocurrency from the 2017 bull market lost more than 90% of its value on Uniswap early Friday after the hacker behind Binance’s security breach began selling millions of tokens into a market with insufficient liquidity.

FUNToken (FUN), formerly known as FunFair, dropped from approximately 0.0000037 wrapped ether (WETH) to 0.00000017 WETH in the affected trading pool, according to GeckoTerminal. Across all markets, the token declined 68% over 24 hours, CoinGecko data shows.

FUN emerged during the 2017 cryptocurrency boom. Its developer, FunFair Technologies, raised $26 million through a four-hour token sale in July 2017 to finance blockchain-based online casino games. The project has since transitioned to the FUNToken brand.

The sharp decline followed selling activity by the attacker responsible for the Binance breach, which involved more than $6 billion in cryptocurrency assets taken from the exchange’s hot wallets. The internet-connected wallets are used to facilitate customer withdrawals, making the incident the largest crypto theft on record.

The stolen portfolio included major assets such as USDT, USDC, Bitcoin, Ether, TRON and Solana, according to Arkham Intelligence. It also contained smaller cryptocurrencies, including FUN, PROM, RSR, RED, OGN and GTC, based on an analysis by Joshua Frank, co-founder and CEO of The Tie.

Tether and Circle responded by freezing stolen tokens under their control, while other stablecoin issuers followed with similar measures. FUNToken also asked centralized exchanges to temporarily disable FUN deposits. However, decentralized platforms such as Uniswap continued to operate, allowing the attacker to sell through their liquidity pools.

Attacker Sells 134.1 Million FUN Tokens

Etherscan data shows that a wallet labeled “Binance Hot Wallet Exploiter 2” transferred 714.9 million FUN to a new address, 0x06ea…685f, at 23:28 UTC on Thursday.

The receiving wallet began selling the tokens on Uniswap’s FUN/WETH pool three minutes later. It executed more than 150 sales over the following hours, with all but one routed through Uniswap v2. The remaining transaction took place on PancakeSwap.

The final sale was recorded at 04:17 UTC on Friday. In total, the wallet exchanged 134.1 million FUN for 111.5 ETH, worth approximately $250,000.

Frank had previously estimated the stolen FUN holdings to be worth $6.23 million. Based on that valuation, the tokens sold represented approximately $1.17 million, meaning the attacker received only around 21% of their estimated market value.

Limited Uniswap Liquidity Deepens the Selloff

The size of the trading pool was a major factor behind FUN’s steep decline. At the time of reporting, the FUN/WETH pool contained only about $16,000 in liquidity, split evenly between the two assets.

Uniswap uses automated market-making pools instead of traditional order books. When someone sells FUN, the pool’s FUN balance increases while its WETH balance decreases. This changes the exchange rate automatically, and the impact becomes much larger when the pool has limited liquidity.

Frank had previously warned that the hacker’s token holdings were large relative to the trading activity in these smaller markets. His analysis on X compared the value of the stolen tokens with their daily trading volumes.

FUN ranked first, with the hacker’s holdings valued at $6.23 million, equal to 252% of its daily trading volume. PROM also featured among the tokens facing significant exposure.

“The hacker holds more than an entire day’s reported trading volume in FUN and PROM,” Frank wrote.

He noted that daily volume is only an approximate measure of a market’s ability to absorb large sell orders.

FUN Rebounds 75% as More Tokens Remain in Hacker’s Wallet

After the selling stopped, buyers returned to the FUN/WETH pool, pushing its price up 75% over the following hour.

The attacker still holds a substantial amount of the token. Etherscan shows approximately 580.8 million FUN remaining in the selling wallet, equivalent to 5.4% of the token’s maximum supply. Further transfers and sales could therefore trigger another wave of volatility.

Other smaller cryptocurrencies linked to the attacker also declined. Reserve Rights (RSR) dropped 17.6% over 24 hours, while RedStone (RED) fell 17.1% and Gitcoin (GTC) lost 16.6%.

Origin Protocol (OGN), yearn.finance (YFI) and 1inch (1INCH) recorded losses ranging from 9% to 13.6%, according to CoinGecko. Bitcoin and Ether declined by 1.8% and 2.9%, respectively.

Etherscan records show the attacker’s main wallet, 0x5227…2f8c, sold these assets through dozens of transactions on Uniswap and PancakeSwap.

Frank identified FUN, PROM, RSR, RED, OGN, SOPH, ERA and GTC as the key tokens to watch. He said the main concern is how much of the stolen supply remains transferable, how rapidly the attacker can liquidate it and whether the available liquidity in each market can withstand additional selling.