Stablecoin

View

SAFU

would

Aave

<div class="light-yellow-block">
 <h2 id="strong-key-takeaways-strong"><strong>Key Takeaways</strong></h2>
 <ul>
  <li><strong>Attacker borrowed about 19,762 ETH against USDT.</strong></li>
  <li><strong>Borrowing came 41 minutes before Aave’s freeze.</strong></li>
  <li><strong>$59.9M collateral still backs $43.8M of debt.</strong></li>
  <li><strong>Freeze also pinched ordinary Aave borrowers.</strong></li>
 </ul>
</div>
<p><a href="https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history" rel="noopener noreferrer nofollow">TRM Labs’ investigation</a> traced the Aave position to an attacker-linked wallet that supplied 60 million USDT as collateral, alongside separate stablecoin sales to market makers.</p>
<h2 id="why-borrow-instead-of-sell">Why borrow instead of sell</h2>
<p>Stolen stablecoins carry a built-in risk for a thief: their issuers can freeze them. Tether and Circle went on to freeze billions in this incident, which Binance has confirmed at about $6.3 billion, with losses to be covered from its SAFU fund and company funds, according to its <a href="https://www.binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7" rel="noopener noreferrer nofollow">initial findings</a>. Several blockchain investigators, including TRM Labs and Chainalysis, have <a href="https://coindoo.com/binance-confirms-biggest-ever-6-3b-hack-north-korea-blamed/" rel="noopener noreferrer nofollow">attributed the theft to North Korea</a>, pointing to TraderTraitor, the state-backed group the FBI blamed for the $1.5 billion Bybit hack in 2025.</p>
<p>Native ETH has no issuer and no blacklist. <a href="https://www.elliptic.co/insights/binance-largest-hack-in-history/" rel="noopener noreferrer nofollow">Elliptic</a> identifies converting stolen funds into native assets as central to the attacker’s response to the freezes. Borrowing against USDT did that without a sale: the stablecoins stayed on Aave as collateral, and the attacker walked away with ETH.</p>
<p>The timing matters. Both borrowing transactions landed at 20:59 and 21:00 UTC, before the <a href="https://coindoo.com/binance-founder-cz-confirms-hack-user-funds-safe/" rel="noopener noreferrer nofollow">first Tether freeze was reported</a> shortly after 21:00.</p>
<h2 id="two-transactions-19-762-eth">Two transactions, 19,762 ETH</h2>
<p>Etherscan labels the borrowing address <a href="https://etherscan.io/address/0x8d53903625b8e839b9df4bd28b0efb1cd6b8639a" rel="noopener noreferrer nofollow">“Binance Hot Wallet Exploiter 3.”</a> In each transaction, wrapped ether, or WETH, the token version of ETH that lending apps use, left Aave’s reserve, was unwrapped and arrived in the wallet as native ETH.</p>
<div style="margin: 24px 0; display: grid; grid-template-columns: repeat(auto-fit, minmax(220px, 1fr)); gap: 14px;">
 <div style="padding: 16px 18px; border: 2px dashed rgba(129,140,248,0.6); border-radius: 10px;">
  <p style="margin: 0; font-family: ui-monospace, Menlo, Consolas, monospace; font-size: 22px; font-weight: bold; color: #818cf8;">20:59:11</p>
  <p style="margin: 4px 0 8px; font-size: 13px; opacity: 0.75;">UTC, October 29</p>
  <p style="margin: 0; font-size: 18px; font-weight: bold;">+3,271.4 ETH</p>
  <p style="margin: 4px 0 0; font-size: 14px;"><a href="https://etherscan.io/tx/0x01b3406c2bcf1b9206c38dce48a9a98f9fb988438cc971f374ea5ed982e2d870" rel="noopener noreferrer nofollow">View transaction</a></p>
 </div>
 <div style="padding: 16px 18px; border: 2px dashed rgba(129,140,248,0.6); border-radius: 10px;">
  <p style="margin: 0; font-family: ui-monospace, Menlo, Consolas, monospace; font-size: 22px; font-weight: bold; color: #818cf8;">21:00:59</p>
  <p style="margin: 4px 0 8px; font-size: 13px; opacity: 0.75;">UTC, October 29</p>
  <p style="margin: 0; font-size: 18px; font-weight: bold;">+16,491.0 ETH</p>
  <p style="margin: 4px 0 0; font-size: 14px;"><a href="https://etherscan.io/tx/0xa85ad4807b33ad63ba2b2ffbac63d913285eefe44d7e56495a4856e6374d9d5f" rel="noopener noreferrer nofollow">View transaction</a></p>
 </div>
</div>
<p style="margin: -8px 0 22px; font-size: 14px; text-align: center;">Total: about <strong>19,762.4 ETH</strong> · Aave’s first market freeze followed at <strong>21:42</strong>, 41 minutes later</p>
<h2 id="what-aave-s-freeze-could-and-couldn-t-do">What Aave’s freeze could and couldn’t do</h2>
<p>Risk provider LlamaRisk set out Aave’s response in an <a href="https://governance.aave.com/t/binance-hot-wallet-exploit-aaves-response/25954" rel="noopener noreferrer nofollow">incident update at 01:00 UTC on October 30</a>:</p>
<div style="margin: 20px 0; font-size: 15px;">
 <p style="margin: 0 0 8px;"><span style="color: #ef4444; font-weight: bold;">✗</span> &nbsp;New supply blocked</p>
 <p style="margin: 0 0 8px;"><span style="color: #ef4444; font-weight: bold;">✗</span> &nbsp;New borrowing blocked</p>
 <p style="margin: 0 0 8px;"><span style="color: #22c55e; font-weight: bold;">✓</span> &nbsp;Repayments, permitted withdrawals and liquidations still allowed</p>
 <p style="margin: 0;"><span style="color: #94a3b8; font-weight: bold;">–</span> &nbsp;Already-borrowed ETH stays with the borrower</p>
</div>
<p>A market freeze stops the next loan, not the last one. The ETH the attacker borrowed stayed in the attacker’s control, though it remains visible onchain, and any later transfer to an exchange or custodian could give investigators a point to intervene. Blacklisting the borrower’s address with the stablecoin issuer is also a separate step from immobilizing the USDT already sitting inside Aave’s lending contract.</p>
<h2 id="the-loan-the-attacker-left-behind">The loan the attacker left behind</h2>
<p>At 01:00 UTC, LlamaRisk put the position at:</p>
<div style="margin: 22px 0; display: flex; flex-wrap: wrap; align-items: stretch; justify-content: center; gap: 10px; text-align: center;">
 <div style="flex: 1 1 130px; padding: 14px 10px; border-radius: 10px; border: 1px solid rgba(38,161,123,0.6);">
  <p style="margin: 0; font-size: 12px; opacity: 0.75;">Collateral (USDT)</p>
  <p style="margin: 4px 0 0; font-size: 24px; font-weight: bold; color: #26a17b;">$59.9M</p>
 </div>
 <div style="flex: 0 1 110px; padding: 14px 10px;">
  <p style="margin: 0; font-size: 22px;">⚖</p>
  <p style="margin: 2px 0 0; font-size: 13px;">buffer <strong>$16.1M</strong></p>
  <p style="margin: 0; font-size: 12px; opacity: 0.75;">loan-to-value ~73%</p>
 </div>
 <div style="flex: 1 1 130px; padding: 14px 10px; border-radius: 10px; border: 1px solid rgba(129,140,248,0.6);">
  <p style="margin: 0; font-size: 12px; opacity: 0.75;">Debt (ETH)</p>
  <p style="margin: 4px 0 0; font-size: 24px; font-weight: bold; color: #818cf8;">$43.8M</p>
 </div>
</div>
<p>LlamaRisk described the position as overcollateralized and subject to normal liquidation. So taking the ETH did not, on that snapshot, leave Aave with a loss equal to the loan. The debt and the collateral have to be read together: a collateral balance on a block explorer is not spendable cash, and a debt token shown without a price is still a debt.</p>
<p>The same applies to the theft tally. The 60 million USDT and the ETH borrowed against it are one position, so counting both as separate Binance losses would double-count the collateral.</p>
<h2 id="what-a-higher-eth-price-would-do-to-the-loan">What a higher ETH price would do to the loan</h2>
<p>The collateral is dollar-linked, but the debt is in ETH. When ETH rises, the debt grows in dollar terms while the USDT stays flat, and accruing interest adds to the debt as well. Under <a href="https://aave.com/help/borrowing/liquidations" rel="noopener noreferrer nofollow">Aave’s health-factor framework</a>, a position can be liquidated once its collateral, adjusted by a liquidation threshold, no longer covers the debt.</p>
<p>The $43.8 million debt figure implies ETH at about $2,216. Holding the 19,762.4 ETH debt fixed:</p>
<div style="margin: 20px 0; max-width: 420px;">
 <table style="width: 100%; border-collapse: collapse; text-align: left; font-size: 15px;">
  <thead>
   <tr style="border-bottom: 2px solid #818cf8;">
    <th style="padding: 8px;" scope="col">ETH price</th>
    <th style="padding: 8px;" scope="col">Debt in dollars</th>
   </tr>
  </thead>
  <tbody>
   <tr style="border-bottom: 1px solid rgba(148,163,184,0.3);">
    <td style="padding: 8px;">~$2,216</td>
    <td style="padding: 8px;">$43.8M</td>
   </tr>
   <tr style="border-bottom: 1px solid rgba(148,163,184,0.3);">
    <td style="padding: 8px;">$2,500</td>
    <td style="padding: 8px;">$49.4M</td>
   </tr>
   <tr style="border-bottom: 1px solid rgba(148,163,184,0.3);">
    <td style="padding: 8px;">$2,750</td>
    <td style="padding: 8px;">$54.3M</td>
   </tr>
   <tr>
    <td style="padding: 8px; color: #ef4444; font-weight: bold;">~$3,031</td>
    <td style="padding: 8px; color: #ef4444; font-weight: bold;">$59.9M, equal to the collateral</td>
   </tr>
  </tbody>
 </table>
</div>
<p>That last row is the outer limit, not the trigger. Because Aave counts collateral at a liquidation threshold below 100%, the position would become liquidatable well before ETH reached about $3,031. The exact point depends on the market’s parameters, oracle prices and accrued interest at a given block. In a liquidation, a liquidator repays part of the debt and receives collateral plus a bonus.</p>
<h2 id="the-cost-for-ordinary-aave-users">The cost for ordinary Aave users</h2>
<p>Freezing deposits to stop the attacker also cut fresh liquidity for everyone else, while existing suppliers kept withdrawing. In a <a href="https://governance.aave.com/t/risk-stewards-temporary-slope2-reductions-on-aave-v3-and-aave-v4-2026-10-30/25955" rel="noopener noreferrer nofollow">separate October 30 recommendation</a>, LlamaRisk proposed temporary interest-rate cuts, noting that utilization had risen as suppliers pulled funds and that higher rates would squeeze borrowers without drawing in new deposits while reserves were frozen. Which changes were carried out has not yet been confirmed.</p>
<p>The ETH is gone from Aave. What happens to the 60 million USDT behind it, through repayment, liquidation or a recovery action against the collateral, now decides how the attacker’s loan is finally settled.</p>
<p style="text-align: center; font-size: 13px; opacity: 0.75;"><em>This article is provided for informational purposes only and does not constitute financial or investment advice.</em></p>
<p>The post <a href="https://coindoo.com/how-the-binance-hacker-outsmarted-stablecoin-freezes/" rel="noopener noreferrer nofollow">How the Binance Hacker Outsmarted Stablecoin Freezes</a> appeared first on <a href="https://coindoo.com" rel="noopener noreferrer nofollow">Coindoo</a>.</p>

How the Binance Hacker Outsmarted Stablecoin Freezes

Table of Contents

Coindoo.com

Other articles published on Oct 30, 2026

Join our free newsletter for daily crypto updates!