The attackers behind the Binance security breach, which BitcoinKE has described as the largest crypto exploit in history, turned to decentralised finance (DeFi) lending protocol Aave to convert stolen stablecoins into Ethereum, seeking to move assets beyond the reach of centralised issuers capable of freezing them.

On-chain data shows that a wallet linked to the attackers deposited approximately $60 million in stolen USDT as collateral on Aave V3 on Ethereum and borrowed 19,762 wrapped Ether (WETH), worth about $44.6 million at the time. The manoeuvre offered a path around one of investigators' most reliable tools: issuer-level stablecoin freezes.

Why Stablecoin Thieves Target Ether

The strategy highlights a key vulnerability in crypto theft investigations. While stablecoins such as USDT and USDC can be frozen by their issuers when linked to suspected criminal activity, Ethereum has no central issuer with the same ability to blacklist individual addresses and prevent transfers. USDT issuer Tether and USDC issuer Circle have both previously blacklisted addresses linked to illicit activity.

By borrowing through Aave, the attackers effectively used the stolen USDT as collateral to obtain an alternative asset without having to sell the stablecoins directly for ETH on a centralised exchange. Wrapped Ether is a tokenised form of Ether designed for use in smart contracts, and it has no issuing company able to blacklist addresses or freeze balances. The borrowed WETH could then be moved through other wallets and converted into ETH, making the proceeds harder to immobilise through issuer-level freezes.

A 40-Minute Window Before the Freeze

Timing was critical. The Aave transaction took place between 20:58 and 21:01 UTC, approximately 40 minutes before the first emergency freeze of Aave markets. This gave the attackers an opportunity to borrow against the collateral before the protocol restricted new lending activity.

In a subsequent statement, Aave confirmed that the position held approximately $59.9 million in USDT collateral against $43.8 million in outstanding debt. The protocol said the position was over-collateralised — meaning the collateral posted exceeded the debt owed — remained subject to normal liquidation procedures, and did not expose Aave suppliers to losses.

The incident prompted Aave to coordinate an emergency response with its risk service providers, freezing reserves across multiple networks to prevent further deposits and borrowing. The intervention covered 175 reserves on Aave V3 across 16 networks and 117 reserves on Aave V4 across four networks.

Not an Exploit of Aave's Contracts

Importantly, the incident did not involve an exploit of Aave's smart contracts. Instead, the attackers used the protocol's legitimate lending functionality as an exit route, demonstrating how decentralised financial infrastructure can become part of the laundering process following major exchange breaches.

The episode also exposes a difficult challenge for DeFi protocols: how to provide permissionless access to financial services while responding to criminal activity that can rapidly move through otherwise functioning lending and trading infrastructure.

With the emergency freezes in place, the immediate questions are how the attackers' still-open position is resolved through Aave's normal liquidation procedures, and whether the borrowed WETH moves further through additional wallets — developments that will show how issuer-level controls and permissionless lending infrastructure interact once stolen funds move between them.

Source: BitcoinKE