Binance Hackers Used Aave to Convert Stolen Stablecoins Into Ether

How Aave was used

On-chain data shows a wallet tied to the attackers deposited approximately $60 million in stolen USDT as collateral on Aave V3's Ethereum market and borrowed 19,762 wrapped Ether (WETH), worth about $44.6 million at the time. The move converted USDT, which issuer Tether can freeze, into wrapped ether, which has no central issuer able to blacklist individual addresses. The borrowed WETH could then be routed through other wallets and converted into ETH, making the proceeds harder to immobilise.

The transaction took place between 20:58 and 21:01 UTC, roughly 40 minutes before the first emergency freeze of Aave markets.

Aave's response

Aave risk service provider LlamaRisk said in an October 30, 2026 governance forum update that it coordinated an emergency response with Aave Labs, TokenLogic and Certora within 10 minutes of the first reports. The effort resulted in 175 reserves being frozen across 16 networks on Aave V3 and a further 117 reserves across four networks on Aave V4. Affected networks included Ethereum, Arbitrum, Avalanche, Base, BNB Chain, Optimism and Polygon. The freezes were executed by Aave's guardian multisig between 21:42 and 23:04 UTC on October 29.

Stablecoin issuers Tether and Circle also moved to freeze assets linked to the incident.