After stealing $3.79 billion from Binance, the attacker moved quickly to convert stablecoins into assets that could not be frozen by issuers. On October 29, between 20:58 UTC and 21:01 UTC, the hacker deposited $60 million USDT on Aave and borrowed 19,760 WETH ($45.13 million).
Simultaneously, the attacker swapped $325 million USDT using UniswapX and 1inch between 21:34 UTC and 21:09 UTC. To accelerate these transactions before asset freezes took effect, the hacker paid a 10% premium. The Aave borrowing completed in approximately 5 minutes, while the UniswapX transfers took about 35 minutes.
Tether and Circle began freezing assets around 21:18 UTC. By that time, the attacker had already unwrapped the borrowed WETH into native ETH and accumulated approximately 420,000 ETH from multiple sources: the original 200,000 ETH taken from Binance, 142,000 ETH from unwrapped WETH, and additional non-stablecoin assets obtained through swaps.
Aave's Position and Collateral Status
The incident left Aave holding $60 million in USDT collateral against the borrowed ETH. Aave founder Stani Kulechov addressed concerns that the platform faced bad debt similar to the KelpDAO hack, which had left Aave with over $120 million in losses. Kulechov stated that the Binance hack collateral was over-collateralized with stable collateral and differed from the KelpDAO situation.
However, questions remain about asset recovery. The $60 million USDT frozen as collateral could potentially be returned to Binance as the primary victim or to Aave as a secondary victim.
Industry Response
According to Chainalysis, cryptocurrency platforms operating wallets on Ethereum should upgrade security measures to address the vulnerability the attacker exploited. The incident raised questions about transaction approval processes, particularly how large transfers from hot wallets proceeded without additional safeguards.
