🔓 Stole USDT — borrowed ETH: how the Binance hacker used Aave
The attacker deposited 60 million USDT as collateral and borrowed about $44.6 million in ETH. The stablecoins remained in the protocol, while the attacker withdrew the coins they borrowed.
The calculation is simple: Tether can freeze USDT, but ETH has no issuer with a button like that. The hacker doesn’t have to repay the loan to get the collateral back—the money wasn’t theirs to begin with.
After being deposited, the USDT sits in Aave’s shared pool. Freezing the hacker’s wallet no longer affects it. Freezing the pool itself would also affect other users.
Who pays for the loan now? For the time being, it’s covered by the collateral left behind: around $60 million against $45 million in debt. According to LlamaRisk, at the time of its assessment, depositors were not at risk. If the collateral’s value approaches the set threshold relative to the debt, other participants can repay part of the loan and claim the corresponding share of the collateral—without the hacker’s consent.
To prevent the attacker from repeating the scheme with other stolen assets, Aave temporarily restricted new deposits and loans. Withdrawals and repayments continued to work.
The attacker deposited 60 million USDT as collateral and borrowed about $44.6 million in ETH. The stablecoins remained in the protocol, while the attacker withdrew the coins they borrowed.
The calculation is simple: Tether can freeze USDT, but ETH has no issuer with a button like that. The hacker doesn’t have to repay the loan to get the collateral back—the money wasn’t theirs to begin with.
After being deposited, the USDT sits in Aave’s shared pool. Freezing the hacker’s wallet no longer affects it. Freezing the pool itself would also affect other users.
Who pays for the loan now? For the time being, it’s covered by the collateral left behind: around $60 million against $45 million in debt. According to LlamaRisk, at the time of its assessment, depositors were not at risk. If the collateral’s value approaches the set threshold relative to the debt, other participants can repay part of the loan and claim the corresponding share of the collateral—without the hacker’s consent.
To prevent the attacker from repeating the scheme with other stolen assets, Aave temporarily restricted new deposits and loans. Withdrawals and repayments continued to work.
