Binance Hackers Used Aave to Shift Stolen Funds Beyond Issuer Freezes

The approach exposes a difference in how crypto assets can be controlled. BitKE noted that stablecoins such as USDT and USDC can be frozen by their issuers when tied to suspected criminal activity, while Ethereum has no central issuer able to blacklist specific addresses or block transfers.

Timing was central to the operation. According to BitKE, the Aave transaction occurred between 20:58 and 21:01 UTC, roughly 40 minutes before the first emergency freeze of Aave markets, giving the attackers a window to borrow against the collateral.

Industry participants moved quickly in response. Cointelegraph reported that firms including Tether and Circle acted to immobilise billions of dollars in assets as the attackers raced to convert the stolen stablecoins into crypto that issuers could not freeze. CoinDesk reported that Tether, Circle and others blocked billions in stolen crypto within hours, though legal experts it spoke to questioned whether smaller victims would receive the same level of protection.

Analysts at Cantor Fitzgerald, TD Cowen and Compass Point say a multibillion-dollar Binance breach is unlikely to stall the crypto market's recovery.