Binance Hacker Outsmarts Tether Freezes Via Aave
Key Summary
North Korea’s TraderTraitor executed a $3.79B exploit against Binance on Thursday, bypassing Tether and Circle blacklists by instantly depositing $60M USDT into Aave to borrow 19,760 WETH.
Key Bullets
- North Korea’s TraderTraitor executed a massive $3.79B sweep on the Ethereum network, draining hot wallets and immediately routing capital into decentralized liquidity pools.
- The attacker deposited $60M USDT into Aave and borrowed 19,760 WETH within five minutes to outpace incoming blacklist blocks from stablecoin issuers Tether and Circle.
- On-chain transaction records confirm the hacker unwrapped the borrowed WETH into 142,062 native ETH before centralized issuers initiated wallet freezes at 21:18 UTC.
- Aave founder Stani Kulechov confirmed the credit position remains over-collateralized with stable collateral, leaving the protocol with zero bad debt despite the exploit.
Hackers Drain Billions From Binance Wallets
North Korea’s TraderTraitor executed an initial $3.79B sweep across the Ethereum network on Thursday, according to on-chain transaction records monitored by Chainalysis. The attacker targeted Binance hot wallets, siphoning 200,630 ETH and assorted stablecoin balances. Recognizing that centralized issuers would rapidly blacklist addresses, the hacker initiated automated countermeasures to lock down liquidity across non-custodial markets.
The exploit moved at rapid speed across decentralized order books. Between 20:58 UTC and 21:01 UTC, the attacker deposited $60M USDT as collateral on Aave and borrowed 19,760 WETH valued at $45.13M. This rapid borrowing action finished in five minutes. Tether and Circle did not begin issuing freeze commands until 21:18 UTC.
Aave Liquidity Avoids Centralized Blacklist Freezes
Public on-chain transaction records confirm the attacker used UniswapX and 1inch to swap an additional $325M USDT between 21:09 UTC and 21:34 UTC. Traders paid a 10% premium fee to fast-track orders ahead of expected blacklist blocks. By converting stolen stablecoins into unfreezable assets, the attacker bypassed centralized restrictions entirely.
Aave founder Stani Kulechov stated via public statements that the borrowing position remains fully over-collateralized by stable assets. This structural setup averted the bad debt crisis seen in past incidents like the KelpDAO exploit, which left Aave with over $120M in bad debt. The protocol holds the collateral safely while the attacker retains liquid native ETH.
Unresolved Questions Remain Over Liability Recovery
Questions remain over how hot wallet permissions allowed over $1.00M, let alone $325M, to transfer out of exchange hot wallets without human review. Centralized exchanges enforce strict withdrawal caps, but non-custodial decentralized protocols operate automatically without administrative intervention.
Bankruptcy dockets and recovery teams face a complex dispute regarding who holds claim to the $60M collateral locked inside Aave. It remains unclear whether funds will be returned to Binance or retained by Aave. Security firms urge all teams running vulnerable Ethereum integration setups to upgrade immediately.
About CryptoNewsFree Market Intelligence Wire
The CryptoNewsFree Market Intelligence Wire provides rapid, objective coverage of breaking crypto developments, regulatory actions, and market liquidity trends. Our reporting strictly follows our Editorial & Verification Standards.