19,762 Wrapped Ether Borrowed From Aave Worth $44.6 Million After Binance Breach
Key Facts
A wallet in a cluster linked to the attacker borrowed 19,762 units of Wrapped Ether, worth nearly $44.6 million at the time, after depositing $60 million in USDT as collateral in the Aave V3 market on Ethereum. The transactions took place between 20:58 and 21:01 UTC on Oct. 29, according to an analysis by LlamaRisk published on Aave’s governance forum. The transaction shows funds linked to the breach being used to borrow through the protocol, while Aave said the position was overcollateralized and did not put its suppliers at risk. On Oct. 30, the company estimated the outstanding collateral at $59.9 million against debt of $43.8 million. The position remains subject to liquidation under normal mechanisms, it said.
Transfers that LlamaRisk’s analysis linked to the incident began at 20:24 UTC on Oct. 29, when a Binance hot wallet on Ethereum sent about 63 assets, along with 167,464 Ether, to a single address in one transaction. The address later received another 28,006 Ether from a second Binance hot wallet. Binance estimated the incident’s total impact at about $6.3 billion and said it had frozen about $3 billion in on-chain assets by the time of its initial statement. The company said it would cover the losses with funds from its SAFU fund and its own capital. Those figures reflect Binance’s estimate of the broader incident, while the Aave borrowing represents part of the movement of funds linked to the attacker.
Binance said its initial investigation points to a possible link between the incident and a compromised laptop belonging to a DevOps engineer, which enabled the attacker to access a service container and send unauthorized withdrawal transactions. It added that it had found no evidence that private wallet keys were leaked. The company temporarily suspended deposits and withdrawals while completing security checks, and engaged law enforcement and blockchain intelligence partners to trace the funds and attempt to recover them. Deposits were unaffected, it said, and pending withdrawals were expected to resume within one or two days, according to the Associated Press on Oct. 30. Binance added that it would publish a technical review after the investigation was complete and the facts had been verified.
TRM Labs attributed the attack, with a high degree of confidence, to North Korea’s TraderTraitor unit, while Binance said it was working with law enforcement to confirm the identity of those responsible. The Associated Press reported that TRM estimated about $6.36 billion was transferred from Binance wallets across 10 blockchain networks, with most transfers taking place in about 20 minutes. The incident follows the February 2025 hack of Bybit, which caused losses of about $1.5 billion; the FBI said at the time that North Korea and its TraderTraitor unit were responsible. The attribution of the Binance incident to the group remains TRM’s assessment, and Binance has not confirmed the attacker’s identity. The company is focused on completing its investigation and tracing the assets in cooperation with the relevant authorities.
In response to the movement of funds, Aave froze 175 reserves across 16 networks in V3 markets and 117 reserves across four networks in V4, according to its statement on Oct. 30. The freeze transactions were carried out between 21:42 and 23:04 UTC on Oct. 29. The measure prevents new deposit or borrowing positions, but keeps repayment, withdrawal and liquidation available; it also bars users from adding collateral to frozen reserves. Aave kept its Horizon real-world asset market open and said it had not halted any market. It chose to freeze markets because restricting the measure to reserves for stolen tokens would have left the attacker other routes; lowering the limits would have required a governance vote and about five days to restore them.
In a measure reported by Aave as of 00:55 UTC on Oct. 30, Ether and Bitcoin were each down about 4% since the funds were withdrawn. The AAVE and LINK governance tokens were each down about 9%, while UNI fell about 8% and ARB about 6% over the same period, according to the same measure. GHO holders also exchanged about 4.6 million units for USDT between 21:49 and 22:07 UTC on Oct. 29. GHO’s price fell from about $0.998 before the withdrawal to $0.997, according to LlamaRisk. Aave linked these moves to the period of the incident and did not present them as closing prices or standalone daily performance.
Aave said markets would remain frozen until the attacker’s funds stopped moving and Binance’s containment measures became clear. It would then work with Aave Labs and other service providers on a phased unfreezing, assessing the order in which reserves would reopen and monitoring usage, without setting a date or timetable. It warned that withdrawals by large suppliers while the freeze remains in place could raise utilization and borrowing rates, while repayment alone would lower both indicators over the same period. Repayment, withdrawal and liquidation remain available under the announced freeze rules. Binance said it would formally announce the resumption of withdrawals after its security checks.