How the Binance Hacker Outsmarted Stablecoin Freezes

Key Takeaways

• Attacker borrowed about 19,762 ETH against USDT.
• Borrowing came 41 minutes before Aave’s freeze.
• $59.9M collateral still backs $43.8M of debt.
• Freeze also pinched ordinary Aave borrowers.

TRM Labs’ investigation traced the Aave position to an attacker-linked wallet that supplied 60 million USDT as collateral, alongside separate stablecoin sales to market makers.

Why borrow instead of sell

Stolen stablecoins carry a built-in risk for a thief: their issuers can freeze them. Tether and Circle went on to freeze billions in this incident, which Binance has confirmed at about $6.3 billion, with losses to be covered from its SAFU fund and company funds, according to its initial findings.

Native ETH has no issuer and no blacklist. Elliptic identifies converting stolen funds into native assets as central to the attacker’s response to the freezes. Borrowing against USDT did that without a sale: the stablecoins stayed on Aave as collateral, and the attacker walked away with ETH.

The timing matters. Both borrowing transactions landed at 20:59 and 21:00 UTC, before the first Tether freeze was reported shortly after 21:00.

Two transactions, 19,762 ETH

Etherscan labels the borrowing address “Binance Hot Wallet Exploiter 3.” In each transaction, wrapped ether, or WETH, the token version of ETH that lending apps use, left Aave’s reserve, was unwrapped and arrived in the wallet as native ETH.

20:59:11

UTC, October 29

+3,271.4 ETH

View transaction

21:00:59

UTC, October 29

+16,491.0 ETH

View transaction

Total: about 19,762.4 ETH · Aave’s first market freeze followed at 21:42, 41 minutes later

What Aave’s freeze could and couldn’t do

Risk provider LlamaRisk set out Aave’s response in an incident update at 01:00 UTC on October 30:

✗  New supply blocked

✗  New borrowing blocked

✓  Repayments, permitted withdrawals and liquidations still allowed

–  Already-borrowed ETH stays with the borrower

A market freeze stops the next loan, not the last one. The ETH the attacker borrowed stayed in the attacker’s control, though it remains visible onchain, and any later transfer to an exchange or custodian could give investigators a point to intervene. Blacklisting the borrower’s address with the stablecoin issuer is also a separate step from immobilizing the USDT already sitting inside Aave’s lending contract.

The loan the attacker left behind

At 01:00 UTC, LlamaRisk put the position at:

Collateral (USDT)

$59.9M

⚖

buffer $16.1M

loan-to-value ~73%

Debt (ETH)

$43.8M

LlamaRisk described the position as overcollateralized and subject to normal liquidation. So taking the ETH did not, on that snapshot, leave Aave with a loss equal to the loan. The debt and the collateral have to be read together: a collateral balance on a block explorer is not spendable cash, and a debt token shown without a price is still a debt.

The same applies to the theft tally. The 60 million USDT and the ETH borrowed against it are one position, so counting both as separate Binance losses would double-count the collateral.

What a higher ETH price would do to the loan

The collateral is dollar-linked, but the debt is in ETH. When ETH rises, the debt grows in dollar terms while the USDT stays flat, and accruing interest adds to the debt as well. Under Aave’s health-factor framework, a position can be liquidated once its collateral, adjusted by a liquidation threshold, no longer covers the debt.

The $43.8 million debt figure implies ETH at about $2,216. Holding the 19,762.4 ETH debt fixed:

ETH price	Debt in dollars
~$2,216	$43.8M
$2,500	$49.4M
$2,750	$54.3M
~$3,031	$59.9M, equal to the collateral

That last row is the outer limit, not the trigger. Because Aave counts collateral at a liquidation threshold below 100%, the position would become liquidatable well before ETH reached about $3,031. The exact point depends on the market’s parameters, oracle prices and accrued interest at a given block. In a liquidation, a liquidator repays part of the debt and receives collateral plus a bonus.

The cost for ordinary Aave users

Freezing deposits to stop the attacker also cut fresh liquidity for everyone else, while existing suppliers kept withdrawing. In a separate October 30 recommendation, LlamaRisk proposed temporary interest-rate cuts, noting that utilization had risen as suppliers pulled funds and that higher rates would squeeze borrowers without drawing in new deposits while reserves were frozen. Which changes were carried out has not yet been confirmed.

The ETH is gone from Aave. What happens to the 60 million USDT behind it, through repayment, liquidation or a recovery action against the collateral, now decides how the attacker’s loan is finally settled.

---