Aave froze 292 reserves for a day after the Binance hack
On Thursday, 29 October, between 20:57 and 21:01 UTC, a wallet belonging to the Binance hacker deposited $60 million in stolen USDT on Aave V3 (Ethereum), then borrowed 19,762 ETH (about $44.6 million). The idea was to swap stablecoins, which Tether can freeze, for ether, which cannot be frozen. The hackers also converted stablecoins into ether on Uniswap.
Within the hour, Aave's Guardians froze 292 reserves on V3 and V4, blocking deposits and borrowing, but not withdrawals or repayments. Its contracts were not attacked, and everything reopened on 30 October in four steps. Kamino, on Solana, suspended borrowing on its SOL/BTC market as a precaution, without being hit.
On 30 October, the value locked in DeFi lost 5.3%, down to $83.95 billion, its lowest level since 21 August, while AAVE and LINK fell 9% and UNI 8%. About $3 billion of the stolen funds is frozen, mostly stablecoins, and since 31 October the FBI has been asking DeFi apps to block the hacker's addresses.
Binance got hacked, and DeFi had to protect itself too
The Binance hack on Thursday, 29 October, did not stop at Binance. To hide the stolen money, the hackers are going through DeFi (apps that lend and swap crypto with no bank or platform in the middle). Less than an hour after the theft, they deposited $60 million in stolen stablecoins (cryptos whose value tracks the dollar) on Aave, the biggest lending app, to borrow ether in return. Aave then paused everything for about a day.
If you had money on Aave, you could still withdraw it during this pause, but you could no longer deposit or borrow. Everything reopened on Friday, 30 October, and nobody lost money on Aave. The total value locked in DeFi still fell 5% in a single day, because prices dropped and many people withdrew their funds to be on the safe side.
Read the expert version
Aave reopens after the Binance hack but keeps LTV at zero on 9 assets
On 29 October, between 20:57 and 21:01 UTC, the hacker deposited $60 million in USDT on Aave V3 Ethereum Core, in two goes ($10 million, then $50 million), and borrowed 19,762 WETH. The position was overcollateralized ($59.9 million against $43.8 million of debt), so it posed no risk to lenders according to LlamaRisk. The hacker also built up about 253,000 ETH through UniswapX and successive swaps, and turned 36 million RLUSD into 15,439 ETH before Ripple's freeze (about $200 million).
Aave Labs, Tokenlogic and Certora set up an emergency cell, then the Guardian multisigs froze 175 V3 reserves on 16 networks and 117 V4 reserves on 4 networks, without waiting for a five-day governance vote. At the reopening on 30 October, LTV was left at zero (a zero collateral factor on V4) for USDT, USDC, USDT0, POL, WAVAX, sAVAX, XAUT, PAXG and OP, and V3 borrowing capacity was cut to $3.7 billion. Stablecoin pools hit 100% utilization, LlamaRisk lowered Slope2, and GHO slipped to $0.997 after 4.6 million were bought back against USDT through the stability module.
Chainalysis describes how the freezes are being bypassed on Tron, with stablecoins deposited on lending protocols and then the receipt tokens transferred, which the issuer cannot block (about $500,000 traced so far). On 31 October, the FBI attributed the attack to TraderTraitor, published hundreds of addresses and named THORChain specifically, which had refused in September to filter funds from the Bitget hack. On 30 October, DeFi TVL fell to $83.95 billion (-5.3%), with AAVE and LINK down 9%, UNI down 8% and ARB down 6%.
