Quick answer
The Binance hacker deposited 60M of stolen USDT into Aave between 20:57 and 21:00 UTC on October 29, 2026, and borrowed 19,762 ETH (about $45M) against it. He never repaid. Tether can freeze USDT in a wallet, but not USDT that sits inside Aave's contract, and nobody can freeze ETH. The trade kept about 75% of the value that a freeze would have wiped out. Tether's first freeze landed at 21:05.
Why the hacker needed Aave
About $2.4B of the Binance hack was in stablecoins. Tether and Circle can freeze those by blacklisting the wallet that holds them. Native ETH and BTC have no issuer, so nobody can freeze them.
That gave the attacker a deadline. Every dollar of USDT he couldn't turn into ETH before the blacklist landed was lost to him. Swapping on DEXs works, but billions of dollars of USDT can't go through DEX pools in a few minutes without heavy slippage. Aave offered a second exit.
The Aave move, second by second
StalkChain transfer data for wallet 0x8d53903625b8e839b9df4bd28b0efb1cd6b8639a:
| UTC, Oct 29 | What happened |
|---|---|
| 20:52:59 | 190M USDT arrives from relay wallet 0x0ddf…697e |
| 20:53:59 | 3,552 ETH arrives from the same relay (from an earlier USDT swap) |
| 20:57:59 | Deposits 10M USDT into Aave and receives 10M aEthUSDT |
| 20:59:11 | Borrows 3,271 ETH |
| 21:00:11 | Deposits another 50M USDT |
| 21:00:59 | Borrows 16,491 ETH |
| 21:01:59 | Sends the remaining 130M USDT to 0x77ed…c3eb |
| 21:02:35 | Sends 23,314.5 ETH to the same wallet: the 19,762 borrowed plus the 3,552 it got earlier |
| 21:05 | Tether's first freeze lands (971M USDT) |
The whole move took five minutes. The ETH was gone two and a half minutes before the first freeze.
Why it worked
The freeze can't reach it. Tether freezes USDT by adding an address to a blacklist in the USDT contract. A blacklisted address can't send its USDT. But once the hacker deposited, the USDT was held by Aave's pool contract, not by his wallet. Blacklisting his address no longer touches it.
The loan is the cash-out. A normal borrower repays to get the collateral back. The hacker never meant to. He handed Aave $60M of USDT that could be frozen and walked away with about $45M of ETH that can't. That is roughly 75 cents on the dollar, against zero if the freeze had caught it.
No counterparty. An OTC desk could refuse the trade. A DEX pool would move the price. Aave's lending market just checks the collateral ratio. Two borrow calls, no one to approve them.
Who is left holding the bag
As of the latest StalkChain check, wallet 0x8d53…639a still holds 60.0M aEthUSDT, the receipt token for the deposit, and owes 19,762 ETH. The loan will never be repaid.
That leaves Aave with $60M of stolen USDT backing an abandoned loan. If ETH rises enough against USDT, the position becomes eligible for liquidation, and liquidators would take the USDT collateral. If Tether later freezes Aave's own balance, things get more complicated, which is why Aave froze its affected markets after the hack. Aave says its contracts were not exploited. It was a cash-out route, not the target.
What happened to the ETH
The ETH didn't stay put. It passed through seven wallets in about 75 minutes. Each hop swapped some USDT and forwarded the rest. It ended up in 0x897c80d1a9729e94460e2bd93178bd5215158df3, one of six wallets now holding about 470,900 stolen ETH. None of them has sent anything to a mixer, bridge or exchange yet. The live timeline tracks those wallets hourly.
What this means for stablecoin freezes
Freezes still worked at scale here: about $3B of the haul is frozen, by Binance's count. But the Aave move shows the limits:
- Freezes are slow next to a prepared attacker. About 700M USDT left the main wallet within nine minutes of the drain, before any freeze.
- DeFi is a way out of a blacklist. Any protocol that takes USDT as collateral and lends out a native asset can be used the same way.
- The cost lands on the protocol. Aave's depositors now carry the risk of a loan nobody will repay.
For how freezes work, and who can freeze what, see can USDT and USDC be frozen?.