How did Binance hacker leverage Aave to outsmart Tether, Circle freeze?

The Binance hacker pre-empted some of the industry’s potential reactions and planned countermeasures, including using Aave and UniswapX to avoid seizures and fund freezes. 

On Thursday, the attacker, now confirmed as North Korea’s TraderTraitor, made an initial $3.79B sweep on the Ethereum network, including 200,630 ETH and some stablecoins. 

Knowing that Tether, Circle, and other platforms would move quickly to freeze the stablecoins and other assets, the attacker deposited $60M USDT on Aave and borrowed out 19,760 WETH ($45.13M). This happened between 20:58 UTC and 21:01 UTC on Thursday, 29th October.  

Similarly, TraderTraitor swapped $325M USDT using UniswapX and Iinch between 21:34 UTC and 21:09 UTC.

In fact, analysts noticed that the hacker was forced to pay 10% of their swapped amount to fast-track the orders before freezing began. The UniswapX transfers took about 35 minutes, while Aave borrowing took only 5 minutes. Subsequently, the hacker unwrapped the WETH and got the native, unfreezable 142,062 ETH.  

Tether and Circle began the freezes by around 21:18 UTC, stopping further conversions. However, the attacker now had 420K ETH (unwrapped 142K ETH, original 200K ETH from Binance wallets, and other swapped non-USDT assets). 

Commenting on the unfortunate but massive scheme, one analyst said, 

The Binance hacker might have just pulled off one of the smartest moves I’ve seen in crypto. Tether can freeze the USDT sitting in the wallet. But it can’t freeze the ETH he already borrowed.

He added, 

So now Aave is left holding frozen collateral, while the hacker is sitting on liquid ETH.

Aave denies bad debt claims after Binance hack

Here, it’s worth noting that the KelpDAO hack leveraged a similar DeFi lending loophole to cash out and launder stolen funds. Aave was left with over $120M in bad debt. 

However, Aave founder Stani Kulechov denied that bad debt claims were applicable to the Binance hack incident. 

Actually, there is no bad debt, in fact, it’s over-collateralized with stable collateral. Kelp was different.

What remains unclear, however, is who will be repaid the $60M: Is it Binance, the primary victim, or Aave, which is also a secondary victim? 

In fact, some have even wondered how over $1M was allowed to be signed off without human review, let alone $325M swept from some of Binance’s hot wallets. For centralized exchanges such as Binance, caps make sense. However, for non-custodial decentralized platforms, it’s a different setup that is designed to have no human intervention. 

According to Chainalysis, platforms running the wallets on Ethereum with the bug that the attacker used should now be vigilant and upgrade accordingly. 

Final Summary

• Binance hacker used Aave and UniswapX to swap $365M USDT to unfreezable +120K ETH.
• Aave denied claims that the incident left it with bad debt like the KelpDAO exploit.