The attackers behind the Binance security breach used decentralised finance (DeFi) lending protocol Aave to convert stolen stablecoins into Ethereum seeking to move assets beyond the reach of centralised issuers capable of freezing them.

On-chain data shows that a wallet linked to the attackers deposited approximately $60 million in stolen USDT as collateral on Aave V3 on Ethereum and borrowed 19,762 wrapped Ether (WETH) worth about $44.6 million at the time.

 

MILESTONE | Binance Gets Hacked in the Largest Crypto Exploit in History

 

The strategy highlights a key vulnerability in crypto theft investigations:

While stablecoins such as USDT and USDC can be frozen by their issuers when linked to suspected criminal activity, Ethereum has no central issuer with the same ability to blacklist individual addresses and prevent transfers.

 

By using Aave, the attackers effectively used the stolen USDT as collateral to obtain an alternative asset without having to sell the stablecoins directly for ETH through a centralised exchange. The borrowed WETH could then be moved through other wallets and converted into ETH making the proceeds harder to immobilise through issuer-level freezes.

 

How Binance Hackers Used AAVE to Cash Out Stolen Crypto

 

The timing was critical.

 

The Aave transaction took place between 20:58 and 21:01 UTC, approximately 40 minutes before the first emergency freeze of Aave markets. This gave the attackers an opportunity to borrow against the collateral before the protocol restricted new lending activity.

Aave subsequently confirmed that the position held approximately $59.9 million in USDT collateral against $43.8 million in outstanding debt. It said the position was

  • over-collateralised,

  • remained subject to normal liquidation procedures, and

  • did not expose Aave suppliers to losses.

 

 

The incident prompted Aave to coordinate an emergency response with its risk service providers freezing reserves across multiple networks to prevent further deposits and borrowing. The intervention covered 175 reserves on Aave V3 across 16 networks and 117 reserves on Aave V4 across four networks.

Importantly, the incident did not involve an exploit of Aave’s smart contracts.

Instead, the attackers used the protocol’s legitimate lending functionality as an exit route demonstrating how decentralised financial infrastructure can become part of the laundering process following major exchange breaches.

 

The episode also exposes a difficult challenge for DeFi protocols:

Providing permissionless access to financial services while responding to criminal activity that can rapidly move through otherwise functioning lending and trading infrastructure.

 

 

DeFi | Why this Primary Risk Management Provider is Exiting the Largest DeFi Lending Protocol

 

 

 

 

Want to keep up with the latest news on crypto globally?

Join our WhatsApp channel here.

Follow us on X for the latest posts and updates

Join and interact with our Telegram community

___________

#DAO #ETH