During the hour Binance was hacked, a textbook arbitrage window opened on-chain. Someone made $3.47 million in an hour. I dug through the on-chain data and reconstructed what happened.
【What happened】 Around 4:24 a.m. Beijing time on October 30, Binance’s hot wallet was hacked. The hacker had a huge amount of USDT and, afraid Tether would freeze it, frantically swapped USDT for ETH on-chain through DEXs. At the same time, Binance suspended withdrawals, so cheap ETH on the exchange couldn’t be moved on-chain. The result:
ETH on Uniswap was bought up to $2,560–$2,750 from 04:40 to 05:40, with some trades above $3,000.
Aave uses Chainlink oracles that aggregate exchange prices. The oracle price stayed at $2,250–$2,290 the whole time, while ETH on-chain was 15%–30% more expensive than on exchanges. The gap lasted nearly an hour.
【The arbitrage playbook】
Deposit USDC/USDT into Aave as collateral
Borrow ETH at the oracle price of about $2,280
Immediately sell it for USDT on a DEX or aggregator at $2,600+
Deposit the USDT you sold back in, then keep borrowing and selling
When the price falls back to around $2,290, buy back ETH to repay the loan. The spread is all profit. This wasn’t an attack on Aave; there was nothing wrong with Aave’s contracts. Essentially, it was arbitrage between CEX and DEX prices. Aave was just a “window for borrowing ETH at exchange prices.”
【On-chain data】 I pulled the addresses that borrowed ETH on Aave mainnet in the 6 hours after the incident: 61 in total. Excluding the hacker’s address (which borrowed 19,762 ETH against $60 million in USDT), I calculated the profit and loss for each trade:
No. 1, 0x0cdd…61D8: sold 12,289 ETH at an average price of $2,580; bought back 12,314 ETH at an average price of $2,297; ▶earned about $3.47 million◀
No. 2 made about $780,000, with a batch of sales above $3,000
Nos. 3–5 made about $670,000, $430,000, and $290,000, respectively
The top 10 made about $6.36 million combined. Across 206 sales, the average sale price was 10% above the oracle price, with the maximum exceeding 30%.
The No. 1 trader’s approach is worth learning from:
Entered just 24 minutes after the incident
Already had $37 million USDC deposited in Aave
Sold in 18 transactions of 300–1,000 ETH each, using an aggregator to split orders and reduce slippage
Started buying back ETH to repay as soon as the price fell, and had mostly closed the position within two hours
【Lessons learned】
When something goes wrong at a CEX and withdrawals are suspended, the price gap between on-chain markets and exchanges can persist for a long time. A gap that would normally be arbitraged away in seconds lasted an hour this time.
Opportunities are in places that price assets using exchange prices: lending pools that use Chainlink oracles (Aave, Compound, Spark, and others). They don’t track the live DEX price.
Have your capital ready in advance. If you wait until you see the news to deposit USDT and open a position, the window will already be gone.
The window is short. The more ETH gets sold on DEXs, the cheaper it gets; how much you can make depends on liquidity and speed. After 05:30, the gap was down to just 3%–5%.
Aave quickly froze its mainnet V3 market, so latecomers couldn’t even borrow.
【Risks】
ETH borrowing positions are exposed to ETH continuing to rise, which can lower the health factor. That’s why large traders split their trades into batches instead of going all in at once.
Any ETH you haven’t bought back remains as debt, and a price rebound can erase your profits.
Gas can get expensive when the chain is congested, making the trade unprofitable for smaller amounts.
The next time a black swan event hits, first figure out where your “ETH borrowing window” is.
(Data: calculated from individual on-chain trades, using an ETH price of $2,280; gas fees not deducted. Not investment advice.)
【What happened】 Around 4:24 a.m. Beijing time on October 30, Binance’s hot wallet was hacked. The hacker had a huge amount of USDT and, afraid Tether would freeze it, frantically swapped USDT for ETH on-chain through DEXs. At the same time, Binance suspended withdrawals, so cheap ETH on the exchange couldn’t be moved on-chain. The result:
ETH on Uniswap was bought up to $2,560–$2,750 from 04:40 to 05:40, with some trades above $3,000.
Aave uses Chainlink oracles that aggregate exchange prices. The oracle price stayed at $2,250–$2,290 the whole time, while ETH on-chain was 15%–30% more expensive than on exchanges. The gap lasted nearly an hour.
【The arbitrage playbook】
Deposit USDC/USDT into Aave as collateral
Borrow ETH at the oracle price of about $2,280
Immediately sell it for USDT on a DEX or aggregator at $2,600+
Deposit the USDT you sold back in, then keep borrowing and selling
When the price falls back to around $2,290, buy back ETH to repay the loan. The spread is all profit. This wasn’t an attack on Aave; there was nothing wrong with Aave’s contracts. Essentially, it was arbitrage between CEX and DEX prices. Aave was just a “window for borrowing ETH at exchange prices.”
【On-chain data】 I pulled the addresses that borrowed ETH on Aave mainnet in the 6 hours after the incident: 61 in total. Excluding the hacker’s address (which borrowed 19,762 ETH against $60 million in USDT), I calculated the profit and loss for each trade:
No. 1, 0x0cdd…61D8: sold 12,289 ETH at an average price of $2,580; bought back 12,314 ETH at an average price of $2,297; ▶earned about $3.47 million◀
No. 2 made about $780,000, with a batch of sales above $3,000
Nos. 3–5 made about $670,000, $430,000, and $290,000, respectively
The top 10 made about $6.36 million combined. Across 206 sales, the average sale price was 10% above the oracle price, with the maximum exceeding 30%.
The No. 1 trader’s approach is worth learning from:
Entered just 24 minutes after the incident
Already had $37 million USDC deposited in Aave
Sold in 18 transactions of 300–1,000 ETH each, using an aggregator to split orders and reduce slippage
Started buying back ETH to repay as soon as the price fell, and had mostly closed the position within two hours
【Lessons learned】
When something goes wrong at a CEX and withdrawals are suspended, the price gap between on-chain markets and exchanges can persist for a long time. A gap that would normally be arbitraged away in seconds lasted an hour this time.
Opportunities are in places that price assets using exchange prices: lending pools that use Chainlink oracles (Aave, Compound, Spark, and others). They don’t track the live DEX price.
Have your capital ready in advance. If you wait until you see the news to deposit USDT and open a position, the window will already be gone.
The window is short. The more ETH gets sold on DEXs, the cheaper it gets; how much you can make depends on liquidity and speed. After 05:30, the gap was down to just 3%–5%.
Aave quickly froze its mainnet V3 market, so latecomers couldn’t even borrow.
【Risks】
ETH borrowing positions are exposed to ETH continuing to rise, which can lower the health factor. That’s why large traders split their trades into batches instead of going all in at once.
Any ETH you haven’t bought back remains as debt, and a price rebound can erase your profits.
Gas can get expensive when the chain is congested, making the trade unprofitable for smaller amounts.
The next time a black swan event hits, first figure out where your “ETH borrowing window” is.
(Data: calculated from individual on-chain trades, using an ETH price of $2,280; gas fees not deducted. Not investment advice.)
