Binance Hackers Use Aave to Borrow $44.6 Million in Ether

2 min read

Hackers behind a $6.36 billion cryptocurrency theft from Binance used the Aave lending protocol to borrow $44.6 million in Ether before stolen stablecoins could be frozen, according to blockchain investigations published after the October 29, 2026 attack.

Blockchain intelligence firm TRM Labs attributed the theft to North Korea’s TraderTraitor hacking group.

Binance confirmed a security incident and temporarily suspended withdrawals on several networks while saying customer funds were safe.

The attack affected wallets across ten blockchains, with most unauthorised transfers beginning around 20:05 UTC on October 29. TRM assessed that attackers likely compromised Binance’s hot-wallet signing infrastructure.

Binance had not published a definitive root cause.

How Hackers Used Aave Lending

According to LlamaRisk, between 20:58 and 21:01 UTC, an attacker-controlled wallet deposited 60 million USDT into Aave V3 Ethereum Core and borrowed 19,762 Wrapped Ether, valued at approximately $44.6 million.

The transaction preceded the first stablecoin freeze at 21:42 UTC by roughly 40 minutes. Unlike issuer-controlled USDT, native Ether cannot be frozen through a centralised blacklist.

The lending position subsequently held $59.9 million in USDT collateral against $43.8 million in debt. LlamaRisk reported that it remained over-collateralised, subject to normal liquidation rules and did not endanger Aave depositors.

Emergency Freezes Across DeFi Markets

Aave initially froze 175 V3 reserves across 16 networks and 117 V4 reserves across four networks. The restrictions prevented new deposits and borrowing while allowing existing users to withdraw, repay loans and undergo liquidations.

By October 31, LlamaRisk’s governance update indicated that affected reserves were no longer frozen, with borrowing rate parameters being restored.

Separately, TRM reported that Tether, Circle, Ripple and World Liberty Financial froze approximately $2.67 billion in stablecoins. Arbitrum’s Security Council also secured cryptocurrency assets through emergency intervention.

Ether Holdings Raise Selling Concerns

TRM estimated that the attackers controlled more than 420,000 ETH and 18,270 BTC, representing approximately $2.4 billion in assets outside centralised issuer controls.

Those holdings present a potential selling risk for Ethereum markets, although their precise impact on prices has not been established.

Investigators continue tracing the stolen assets, with the case highlighting how decentralised lending can allow attackers to obtain transferable cryptocurrency before centralised freezes take effect.