Binance Hacker Used Aave to Dodge Stablecoin Freezes and Escape with $44.6 Million in ETH

The attacker behind the $6.3 billion Binance security breach used Aave to borrow approximately $44.6 million in Ethereum against stolen USDT before emergency measures could restrict further activity. The move highlights how decentralized finance protocols can become an unexpected route for moving stolen assets beyond the reach of centralized stablecoin issuers.

The attacker deposited $60 million in Tether (USDT) into Aave V3 on October 29 and borrowed 19,762 Wrapped Ether (WETH) against the collateral. The transaction took place shortly before Aave introduced emergency restrictions across its lending markets.

Blockchain investigators have also identified separate attempts to convert hundreds of millions of dollars in stablecoins through decentralized trading services, including UniswapX and 1inch. These transactions show how quickly attackers can move between centralized and decentralized infrastructure when trying to avoid asset freezes.

How did the Binance hacker use Aave to avoid stablecoin freezes?

The attacker's strategy relied on a difference between stablecoins and native cryptocurrencies.

Tether and Circle can freeze USDT and USDC by restricting addresses through their respective token contracts. However, ETH does not have a centralized issuer that can blacklist an address and prevent its owner from transferring the asset.

According to Aave risk service provider LlamaRisk, a wallet connected to the Binance exploiter supplied approximately $60 million in USDT to Aave V3's Ethereum Core market between 20:58 and 21:01 UTC on October 29.

In return, the attacker borrowed 19,762 WETH, worth approximately $44.6 million at the time.

WETH is an Ethereum-based token that represents ETH at a one-to-one ratio. The attacker could unwrap the borrowed WETH into native ETH and transfer it to other wallets.

This move effectively changed the asset the attacker controlled. Instead of holding USDT directly in an attacker-controlled wallet, the stablecoins remained as collateral inside Aave while the attacker received ETH.

The distinction matters because a freeze targeting the attacker's wallet does not automatically freeze tokens held by a separate protocol contract. The collateral remains subject to Aave's lending rules and any applicable issuer-level restrictions, but the ETH already borrowed is not automatically returned or frozen when the original wallet is blacklisted.

UniswapX and 1inch helped convert hundreds of millions in USDT

The Aave transaction was only one part of the attacker's broader asset-conversion strategy.

Blockchain analysis by Bitquery found that the attacker also used UniswapX and 1inch Fusion orders to exchange approximately $325 million in USDT for ETH.

These trades took place between approximately 20:34 and 20:49 UTC on October 29. The attacker received around 122,316 ETH through the orders.

However, speed came at a substantial cost. Bitquery estimated that the attacker paid an average price of approximately $2,657 per ETH while the broader market price was around $2,284. That represented a premium of roughly 16%, with the overall trading activity producing losses estimated at 12% to 26% against market prices.

The unusually large orders also pushed prices in decentralized liquidity pools above broader market levels. Arbitrage traders took advantage of the difference, while the attacker prioritized converting stablecoins before further restrictions could take effect.

The transactions demonstrate a difficult trade-off for attackers: waiting for better execution can increase the risk of a freeze, while rushing large swaps can result in significant losses through slippage and execution premiums.

Aave says the Binance exploiter's position is not bad debt

The use of Aave raised concerns about whether the protocol could be left with an unpaid loan backed by stolen and potentially frozen stablecoins.

A similar situation emerged during the April 2026 KelpDAO exploit. Attackers used stolen rsETH as collateral to borrow assets through Aave, contributing to approximately $124.5 million in bad debt.

However, Aave's assessment of the Binance incident is different.

LlamaRisk reported that the exploiter's Aave position contained approximately $59.9 million in USDT collateral against $43.8 million in outstanding debt. The position remained over-collateralized and subject to normal liquidation procedures.

Aave therefore said the position did not put its suppliers at risk.

Aave founder Stani Kulechov also rejected comparisons with the KelpDAO incident, explaining that the Binance position was backed by over-collateralized stablecoin collateral.

The distinction is important. Bad debt occurs when the value of collateral available to repay a loan falls below the outstanding debt and the shortfall cannot be recovered through liquidation. An unpaid loan is not automatically bad debt.

Nevertheless, the position creates a complicated recovery question. The attacker controls the borrowed ETH, while Aave holds the collateral and remains exposed to the possibility of restrictions affecting that collateral.

It is not yet clear how any eventual recovery would be allocated between Binance, the primary victim of the theft, and Aave, which supplied the borrowed ETH. The public risk assessment does not establish a repayment arrangement between the parties.

Aave froze lending markets after the incident

Aave responded by restricting new lending activity across its markets.

According to LlamaRisk's October 30 update, the first emergency freeze began at approximately 21:42 UTC on October 29. The response involved freezing 175 reserves across 16 networks on Aave V3 and 117 reserves across four networks on Aave V4.

The restrictions prevent users from opening new supply and borrowing positions in the affected reserves. However, they do not amount to a complete shutdown of the protocol.

Existing users can still repay loans, permitted withdrawals remain available, and liquidations can continue.

This distinction also explains why the attacker could retain the ETH borrowed before the restrictions took effect. Freezing a lending market prevents new borrowing; it does not automatically reverse completed transactions.

LlamaRisk said Aave would continue monitoring the exploiter's wallets and affected markets before considering a staged reopening.

Does DeFi lending create a new route for laundering stolen crypto?

The Binance incident raises a broader question about the role of decentralized lending protocols in crypto theft.

Traditional centralized platforms can intervene through account restrictions, withdrawal limits, transaction monitoring, and manual reviews. Decentralized lending protocols operate differently. Their smart contracts generally execute borrowing and collateral transactions automatically when the required conditions are met.

That automation is central to DeFi's appeal, but it can also create opportunities for attackers.

An attacker holding stolen stablecoins may be able to deposit them as collateral, borrow a different asset, and move that borrowed asset elsewhere before issuers or protocol administrators respond.

The Aave transaction does not mean its smart contracts were exploited. The attacker used the protocol's normal lending functionality with collateral that was already under their control.

However, the incident exposes a difficult security question: should decentralized protocols introduce additional risk controls when assets associated with a major theft enter their markets?

There are trade-offs. Stronger intervention mechanisms could help limit the use of DeFi in laundering stolen funds, but they could also weaken the permissionless and non-custodial characteristics that users expect from these protocols.

The Binance incident also reinforces the importance of monitoring wallet activity and responding quickly when suspicious collateral enters lending markets.