Binance-linked wallet borrowed $44.6 million of ether on Aave 40 minutes before the protocol froze markets

The Binance attacker used Aave to swap freezable dollars for an asset no issuer can freeze. Between 20:58 and 21:01 UTC, an address in the attacker's wallet cluster deposited 60 million USDT (Tether's dollar token) into the Aave V3 Ethereum Core market and borrowed 19,762 wrapped ether (WETH), worth about $44.6 million. Aave's first emergency freeze came at 21:42, roughly 40 minutes later. Tether can freeze USDT at the token contract, so the attacker posted it as collateral and left with ether, which Tether cannot reach (Altcoin Buzz).

Aave was not hacked. It said its contracts were unaffected and that positions stayed fully collateralized (crypto.news). The defensive freeze still cost other users. Halting new deposits while lenders withdrew pushed up borrowing costs and reopened the argument over how much disruption emergency powers should impose on people who did nothing wrong. Aave has since reopened its V3 and V4 markets, but nine assets still cannot serve as collateral for new borrowing. Decrypt reports that other DeFi venues, including Kamino on Solana, also paused markets as the attacker looked for places to convert funds.

Solana lending liquidity is thin as well. CryptoSlate reports that available USDC on Jupiter Lend rebounded from near zero to about 29 million, roughly 7% of reported total assets, in an October 31 reading. The sources do not show that the Binance theft caused Jupiter's shortage. They do show that a depositor on a fully used pool cannot withdraw until borrowers repay or new deposits arrive.

The pattern repeats April's KelpDAO exploit. Attackers then posted stolen rsETH on Aave and borrowed against it. Stablecoin borrowing rates jumped from roughly 3.5% to 14% within 48 hours, and trapped depositors borrowed about $300 million against their own locked deposits to get cash out (CoinDesk).