The short version
- Aave freeze: a Binance hacker wallet put 60 million USDT on Aave and borrowed 19,762 ETH, about $44.6 million, less than two minutes before Tether froze it.
- Aave froze 175 V3 and 117 V4 markets for about 16 hours so the attacker couldn’t repeat the trade; all reopened Friday, but USDT, USDC and seven other tokens stay at zero LTV.
- The crew is watching the hacker’s loan: at a health factor of 1.06 it gets liquidated if ETH rises about 6%, to roughly $2,365.
The Aave freeze that locked the biggest lending market in DeFi on Thursday night came down to one trade. Between 20:57 and 21:01 UTC, a wallet tied to the $6.3 billion Binance hack put 60 million USDT into Aave and borrowed 19,762 ETH against it, worth about $44.6 million at the time.
Less than two minutes later, Tether froze that wallet. By then the 60 million USDT sat inside Aave as collateral, the ETH had moved on, and there was nothing left to block.
Aave reopened its markets on Friday afternoon and posted this update:
Update following the Binance incident:
All markets are now unfrozen across Aave V3 and V4.
They were frozen as a precaution after initial reports, which paused new deposits and borrows while withdrawals and repayments continued as normal.
Aave contracts were unaffected by the
How the Binance Hacker Used Aave to Dodge Tether
The wallet got 190 million USDT from the attacker’s cluster at 20:52 UTC. It supplied 10 million USDT at 20:57, borrowed about 3,271 ETH, then added 50 million more and borrowed another 16,491 ETH at 21:00.
The first Tether freeze hit the attacker’s main wallet at 21:01:35 UTC. Twenty-four seconds later, this wallet sent its last 130 million USDT elsewhere, and the borrowed ETH followed. Tether blacklisted the Aave wallet at 21:02:47, with nothing left in it to stop.
The price was steep: $60 million in stablecoins for $44.6 million in ETH. For coins that were minutes from being frozen, that’s still a good deal.
Sponsored · Affiliate link
Save 20% on fees trading on WEEX
Base Camp may earn a commission if you sign up. It never affects what we write.
Why Did the Aave Freeze Cover Every Market?
To keep the attacker from doing it again with the rest of the haul. Risk manager LlamaRisk, which joined Aave Labs, TokenLogic and Certora in a war room within 10 minutes, wrote on Aave’s forum that freezing only the stolen tokens would have “left other ways in,” because the attacker could swap into any listed asset.
So the guardian multisigs froze 175 reserves on Aave V3 across 16 networks and 117 on Aave V4 between 21:42 and 23:04 UTC. Nobody could open a new deposit or loan, but withdrawals and repayments kept working. The Aave wallet never came back after 21:01, and it is the attacker’s only position on Aave.
The freeze had a side effect. With deposits blocked, lenders pulled stablecoins out, pushing the big USDT and USDC pools to 92% to 100% use and borrow rates as high as 36% a year. LlamaRisk capped the rate at full use at 10% and cut about $3.7 billion of unused borrow room, so a single wallet couldn’t grab it all the moment markets reopened.
Is Aave Safe to Use After the Unfreeze?
Yes, with one change. All Aave V3 and V4 markets reopened by 13:57 UTC on Friday, ending a 16-hour Aave freeze, but nine tokens the attacker still holds stay at an Aave LTV of zero, short for loan-to-value: USDT, USDC, USDT0, POL, WAVAX, sAVAX, XAUt, PAXG and OP.
That only stops them from backing new loans. You can still supply, withdraw, borrow and repay them, and existing loans keep their liquidation thresholds, so no one’s health factor moved.
The attacker’s own loan is the one to watch. On Aave’s prices it has a health factor of 1.06, so it gets liquidated if ETH climbs about 6%, to roughly $2,365. Liquidators would repay the ETH and take the USDT plus a 4.5% bonus, and Aave’s lenders lose nothing either way.
The bigger fight is on the forum. One member wrote that “we don’t want to become the place hackers go to cash out” and asked for an ATM-style cap on how fast any asset can be borrowed. It’s the second freeze this year: Aave also froze WETH after the Kelp DAO rsETH exploit in April.
SIDE TRAIL: Can Crypto Be Frozen? Who Froze $2.7B of the Binance Hack, and Why $2.4B Got Away
AAVE Price After the Freeze
AAVE took the hit and gave most of it back. It fell from $133.50 before the drain to $115.23 at the low, and trades at $129.24 at the time of writing, up 1.9% in 24 hours. The 50-day MA at $150.05 sits overhead, and $120.29 is the support it bounced from.
TRAIL MAP: DeFi Basics: Swaps, Liquidity Pools and Impermanent Loss
In crypto since 2016. Covers altcoins and the daily market. When not trading, out climbing and traveling.
More from Teddy →
