The attacker behind the Binance hot wallet exploit found a way around the stablecoin freezes: borrowing against the stolen funds instead of selling them. TRM Labs' investigation traced the Aave position to an attacker-linked wallet that supplied 60 million USDT as collateral and walked away with roughly 19,762 ETH — 41 minutes before the lending market was frozen.

Why borrow instead of sell

Stolen stablecoins carry a built-in risk for a thief: their issuers can freeze them. Tether and Circle went on to freeze billions in this incident, which Binance has confirmed at about $6.3 billion, with losses to be covered from its SAFU fund and company funds, according to its initial findings. Several blockchain investigators, including TRM Labs and Chainalysis, have attributed the theft to North Korea, pointing to TraderTraitor, the state-backed group the FBI blamed for the $1.5 billion Bybit hack in 2025.

Native ETH has no issuer and no blacklist. Elliptic identifies converting stolen funds into native assets as central to the attacker's response to the freezes. Borrowing against USDT achieved that without a sale: the stablecoins stayed on Aave as collateral, and the attacker walked away with ETH, while the investigation also noted separate stablecoin sales to market makers.

The timing matters. Both borrowing transactions landed at 20:59 and 21:00 UTC, before the first Tether freeze was reported shortly after 21:00.

Two transactions, 19,762 ETH

Etherscan labels the borrowing address "Binance Hot Wallet Exploiter 3." In each transaction, wrapped ether (WETH) — the token version of ETH that lending applications use — left Aave's reserve, was unwrapped and arrived in the wallet as native ETH.

• 20:59:11 UTC, October 29: +3,271.4 ETH (View transaction)
• 21:00:59 UTC, October 29: +16,491.0 ETH (View transaction)

Total: about 19,762.4 ETH. Aave's first market freeze followed at 21:42, 41 minutes later.

What Aave's freeze could and couldn't do

Risk provider LlamaRisk set out Aave's response in an incident update at 01:00 UTC on October 30:

• New supply blocked
• New borrowing blocked
• Repayments, permitted withdrawals and liquidations still allowed
• Already-borrowed ETH stays with the borrower

A market freeze stops the next loan, not the last one. The ETH the attacker borrowed remained under the attacker's control, though it stays visible onchain, and any later transfer to an exchange or custodian could give investigators a point to intervene. Blacklisting the borrower's address with the stablecoin issuer is also a separate step from immobilizing the USDT already sitting inside Aave's lending contract.

The loan the attacker left behind

At 01:00 UTC, LlamaRisk put the position at:

• Collateral (USDT): $59.9M
• Buffer: $16.1M
• Loan-to-value: ~73%
• Debt (ETH): $43.8M

LlamaRisk described the position as overcollateralized and subject to normal liquidation. Taking the ETH therefore did not, on that snapshot, leave Aave with a loss equal to the loan. The debt and the collateral have to be read together: a collateral balance on a block explorer is not spendable cash, and a debt token shown without a price is still a debt.

The same logic applies to the theft tally. The 60 million USDT and the ETH borrowed against it form a single position, so counting both as separate Binance losses would double-count the collateral.

What a higher ETH price would do to the loan

The collateral is dollar-linked, but the debt is denominated in ETH. When ETH rises, the debt grows in dollar terms while the USDT stays flat, and accruing interest adds to the debt as well. Under Aave's health-factor framework, a position can be liquidated once its collateral, adjusted by a liquidation threshold, no longer covers the debt.

The $43.8 million debt figure implies ETH at about $2,216. Holding the 19,762.4 ETH debt fixed, the position's outer limit sits near $3,031 — but that is the ceiling, not the trigger. Because Aave counts collateral at a liquidation threshold below 100%, the position would become liquidatable well before ETH reached that level. The exact point depends on the market's parameters, oracle prices and accrued interest at a given block. In a liquidation, a liquidator repays part of the debt and receives collateral plus a bonus.

The cost for ordinary Aave users

Freezing deposits to stop the attacker also cut fresh liquidity for everyone else, while existing suppliers kept withdrawing. In a separate October 30 recommendation, LlamaRisk proposed temporary interest-rate cuts, noting that utilization had risen as suppliers pulled funds and that higher rates would squeeze borrowers without drawing in new deposits while reserves were frozen. Which changes were carried out has not yet been confirmed.

The ETH is gone from Aave. What happens to the 60 million USDT behind it — through repayment, liquidation or a recovery action against the collateral — now decides how the attacker's loan is finally settled.

This article is provided for informational purposes only and does not constitute financial or investment advice. It originally appeared on Coindoo.