How the Binance Hacker Outsmarted Stablecoin Freezes

On October 29, an attacker linked to the Binance exploit borrowed about 19,762 ETH from Aave by posting 60 million USDT as collateral, with transactions at 20:59 and 21:00 UTC. Aave froze the market at 21:42 UTC, but the freeze blocked new supply and borrowing while allowing repayments, permitted withdrawals and liquidations, so the borrowed ETH remained with the borrower. LlamaRisk said the position at 01:00 UTC on October 30 held $59.9 million in USDT collateral against $43.8 million of ETH debt and was overcollateralized. Tether and Circle froze stablecoins from the incident, which Binance confirmed at about $6.3 billion and said it would cover from its SAFU fund and company funds.