Updated Sep 14, 2021, 10:27 a.m. Published Nov 4, 2020, 12:22 p.m.
Binance Logo.
Cryptocurrency exchange Binance says it has successfully followed the money trail left by the operator of a scam decentralized finance (DeFi) project and recovered nearly all the stolen funds.
STORY CONTINUES BELOW
Don't miss another story.Subscribe to the Crypto Daybook Americas Newsletter today. See all newsletters
By signing up, you will receive emails about CoinDesk products and you agree to our terms of use and privacy policy.
In an announcement provided to CoinDesk on Thursday, Binance said it has gained custody of an estimated 99.9% of $345,000 worth of cryptocurrency stolen by purported automated market maker Wine Swap in October.
Having raised the funds at launch on Binance Smart Chain in October, the operator fled with users' cryptocurrency "within an hour," Binance said.
The so-called exit scam was executed by moving the 19 different cryptocurrencies held in Wine Swap's address "0xa1eaB5F255DD77fED0D8ea81748422ca7ab0eDc4" to a personal address belonging to the bad actor: "0x4BA023aA9196a354C008aD595F67e268420b7005".
The various coins were moved via cross-chain transfers from Binance Smart Chain to Binance Chain and then to Ethereum, according to Binance.
A small portion of the funds was moved to two exchanges, as well as Binance Bridge, a service that provides access to inter-blockchain liquidity for decentralized applications on Binance Chain and Binance Smart Chain.
The Binance said its security team closely followed the transactions and managed to identify the malicious actor. By then, the scammer had nearly converted all of the funds into stablecoins, as well as Binance coin BNB$871.28, etherETH$2,954.42 and Chainlink's LINK token.
After being contacted by Binance, the scammer returned the funds to the exchange.
"Analysis of the transfers to and from Wine Swap allowed us to identify which addresses fell victim to the scam and calculate exactly how much was owed to them," the exchange said.
Binance now plans to refund the victims' addresses "within the next several days."
Binance had seen some criticism over the fact that the scam project was launched on its platform.
CoinDesk asked the exchange if it had reported the scammer to law enforcement, but a reply hadn't been received by press time.
As of October 2025, GoPlus has generated $4.7M in total revenue across its product lines. The GoPlus App is the primary revenue driver, contributing $2.5M (approx. 53%), followed by the SafeToken Protocol at $1.7M.
GoPlus Intelligence's Token Security API averaged 717 million monthly calls year-to-date in 2025 , with a peak of nearly 1 billion calls in February 2025. Total blockchain-level requests, including transaction simulations, averaged an additional 350 million per month.
Since its January 2025 launch , the $GPS token has registered over $5B in total spot volume and $10B in derivatives volume in 2025. Monthly spot volume peaked in March 2025 at over $1.1B , while derivatives volume peaked the same month at over $4B.