@cryptoblaney posted that the Binance hacker allegedly deposited stolen USDT into Aave as collateral to borrow ETH instead of holding it in a wallet.
[1][2]← Week of Oct 25Oct 25 – Oct 31 UTC Every claim links to the posts behind it01 02 03 04 05 06 07 08 09 10 11 12 13 14 8 posts on X 3 weeks
Narrative / Rank 10 / Week of Oct 25 – Oct 31 / 2nd week running (was #10)
Binance hot wallet drained for ~$2.5B; Aave freezes DAO-operated V3 and V4 markets to stop the attacker borrowing
Peak / day17tracked accounts
Peak dayFriOct 30 · busiest day in the panel
Rest of X / peak day129distinct accounts outside the panel
Cited claims141 dropped by automated checks
Market—no token attached
Attention
Who was talking, day by day
Tracked paneldistinct tracked accounts / day
Rest of Xdistinct other accounts / day
What happened
@cryptoblaney posted that the Binance hacker allegedly deposited stolen USDT into Aave as collateral to borrow ETH instead of holding it in a wallet. @cryptoblaney stated Tether froze $1.5 billion in USDT and Circle froze $800 million in USDC. @cryptoblaney said Tether can freeze USDT sitting in a wallet but cannot freeze the ETH the hacker already borrowed.
+ 11 more in the evidence register ↓Why it matters
The freeze is the first concrete test of Aave's new V3/V4 emergency brake design: it defines, in public, what a lending protocol can and cannot do when stolen collateral lands in its markets, and it puts stablecoin issuers' freeze power next to a collateral position they cannot touch. Because the drained assets included 127,853 AAVE tokens, the event also sits at the center of DeFi lending and CeFi custody risk simultaneously for the first time at this size.
Observed reaction
Mostly awed and slightly amused at the attacker's circular route (deposit stolen USDT into Aave, borrow ETH, walk away), paired with relief that Aave contracts were unaffected and only new deposits/borrows were paused — @mzeller credits Tether, Circle and Aave Labs for reacting fast. The lending-comparison camp (@MSBIntel, @Scott_eth) treats the incident as a moment to re-rank Aave against Jupiter Lend and Compound by loan volume and revenue multiple rather than as a reason to exit.
Spread
Where it started and who carried it
- First seen
- Oct 25, 00:00 UTC by @darklord_gr
- Accounts
- 40 tracked · 125 elsewhere on X
- Communities
- general ct (10), eth defi (8), memecoins solana (5), ai crypto (4)
- Key accounts
- @cryptoblaney, @chainlinkmongol, @smokiemahoney, @tronicssystem, @satoshilambo
Explainability
Evidence register
@cryptoblaney stated Tether froze $1.5 billion in USDT and Circle froze $800 million in USDC.
[1][2][3][4]@cryptoblaney said Tether can freeze USDT sitting in a wallet but cannot freeze the ETH the hacker already borrowed.
[1][2]@0xQuit described the attack chain: a delegate contract deployed from the relayer at 15:59 UTC, an EIP-7702 authorization transaction about four hours later installing malicious delegate code on Binance 14, then a call executing the delegate code.
[1][2][3][4]@aave posted that Aave is aware of reports of a potential incident affecting Binance-affiliated wallets, that Aave's contracts are unaffected and positions remain overcollateralized, and that as a precaution all DAO-operated V3 and V4 markets were frozen, pausing new deposits and borrows while users can still withdraw and repay existing positions.
[1]@AggrNews posted that AAVE FROZES LENDING MARKETS TO PREVENT BINANCE HACKER BORROWING, per onchain data.
[1]@mzeller credited Tether, Circle and Aave Labs with reacting fast and reducing the impact.
[1]@FabianoSolana posted a timestamped timeline: Oct 28 attacker receives 3x 0.1 ETH from Tornado Cash; Oct 29 15:59 malicious delegate/sweeper contract deployed after testing on 3 smaller wallets; 20:04-20:09 233M XRP (~$293M) moved from Binance-linked XRPL wallets (unconfirmed); 20:20 EIP-7702 delegation activated on Binance 14; 20:24 main Binance 14 sweep of 167,464 ETH, 1.615B USDT and 60+ other tokens, ~$2.5B total; 20:24:47 Binance 16 to same attacker destination with 28,006 ETH.
[1]@MSBIntel posted that Jupiter Lend has $981.24M in active loans on Solana, more than Aave has lent on any network except Ethereum, with Aave's next-largest at Plasma ($756.40M) and Compound V3 at $648.53M across all networks.
[1]@aave posted that incentives are live for USDC suppliers in the Aave V4 Coinbase Tokenized Stocks Hub on Base, with users able to deposit USDC to earn rewards on top of the base rate; @ethandefi_ called it one of the safest places to lend USDC on Aave at 5.79% APY against tokenized stocks issued by Coinbase.
[1]@ethandefi_ posted that Aave and Fluid are already working on allowing stablecoin loans backed by BTC held with custodians like Anchorage, in the context of Chainlink CustodySync with Anchorage as official launch partner.
[1]@QuintenFrancois posted that Chainlink launched 24/7 pricing for tokenized stocks, commodities and RWAs, and that Aave is already adopting it for institutional lending.
[1]@Nikitont posted that @EthenaPay added Earn+, offering up to 12% APY in one tap via an Upshift/Steakhouse vault on Aave v4, with no lock-up and withdrawals within 24 hours.
[1]@Scott_eth posted buyback math for ethereum:0x0c1c1c109fe34733fca54b82d7b46b75cfb71f6e against a $48.4B GPU-backed debt market, using Aave's ~25x revenue multiple to value CHIP at $1.5B FDV.
[1]Angles
- Explainer thread: how a Binance hot wallet (Binance 14) drained via an EIP-7702 delegate differs from a CEX API-key hack, and why Aave V3/V4 markets were frozen (not exploited)
- Balance-sheet breakdown: which tokens the attacker drained into Aave (127,853 AAVE, 6.19M UNI, 198.4M ENA) and why collateral-on-Aave is a problem for USDT/USDC freeze authority
- Protocol-precedent angle: Aave freezing only DAO-operated V3/V4 markets while letting ETH borrowers self-repay — a template for emergency action other lending markets may copy
In the playbook for Fri, Nov 6
Formats in use
- Quote-tweet of a protocol's own emergency statement (@aave)
- Copy-paste RT of a narrative post ('The Binance hacker might have just pulled off...')
- Structured asset-list / timeline post with bullet amounts and UTC timestamps
- Aggregator-style one-line breaking news post (all caps)
- DeFi lending market comparison table (TVL/active loans by protocol)
Risks
- Hack details and the $1.5B USDT / $800M USDC freeze amounts are account claims, not confirmed by Tether/Circle/Binance in this dataset — must be labeled unverified/alleged
- The 233M XRP / ~$293M XRPL move is explicitly flagged 'unconfirmed' by the source post
- Quoted APY figures (up to 12% Earn+ on an Aave v4 vault, 5.79% USDC on Aave V4 Base) are promotional numbers and read as financial advice bait — do not amplify as recommendations
- Multiple posts are near-identical copy-paste text across accounts (same phrasing, identical 18,676 likes / 1,637,002 views on three posts), an engagement-farming signal to flag
- Aave freezing markets is a precaution, not a confirmation of loss; framing it as a hack of Aave would be inaccurate
- Do not name or speculate about the attacker's identity
Observed content
Most-engaged posts
RT @cryptoblaney: The Binance hacker might have just pulled off one of the smartest moves I’ve seen in crypto. First, Tether froze $1.5 billion in USDT. Then Circle froze another $800 million in USDC. At that point, it looked like the hacker’s money was trapped. But apparentlOpen on X →
RT @cryptoblaney: The Binance hacker might have just pulled off one of the smartest moves I’ve seen in crypto. First, Tether froze $1.5 billion in USDT. Then Circle froze another $800 million in USDC. At that point, it looked like the hacker’s money was trapped. But apparentlOpen on X →
RT @kennedy_6190: The Binance hacker might have just executed one of the most brilliant moves in crypto. First, Tether froze $1.5 billion worth of USDT. Then Circle followed by freezing another $800 million in USDC. At that point, it seemed like the hacker’s funds were completOpen on X →
RT @czesmaill: The Binance hacker might have just pulled off one of the smartest moves I’ve seen in crypto. First, Tether froze $1.5 billion in USDT. Then Circle froze another $800 million in USDC. At that point, it looked like the hacker’s money was trapped. But apparently,Open on X →
RT @0xQuit: ok safe to say binance is pwned The biggest assets were approximately: • 1.615B USDT • 62.6M RLUSD • 29,934 wBETH • 11,372 XAUt • 6.19M UNI • 198.4M ENA • 7.175T PEPE • 27.8M USD1 • 2.26M LINK • 127,853 AAVE about $2.5B at the explorer’s prices. 1. The attacker deOpen on X →
RT @0xQuit: ok safe to say binance is pwned The biggest assets were approximately: • 1.615B USDT • 62.6M RLUSD • 29,934 wBETH • 11,372 XAUt • 6.19M UNI • 198.4M ENA • 7.175T PEPE • 27.8M USD1 • 2.26M LINK • 127,853 AAVE about $2.5B at the explorer’s prices. 1. The attacker deOpen on X →
RT @0xQuit: ok safe to say binance is pwned The biggest assets were approximately: • 1.615B USDT • 62.6M RLUSD • 29,934 wBETH • 11,372 XAUt • 6.19M UNI • 198.4M ENA • 7.175T PEPE • 27.8M USD1 • 2.26M LINK • 127,853 AAVE about $2.5B at the explorer’s prices. 1. The attacker deOpen on X →
RT @0xQuit: ok safe to say binance is pwned The biggest assets were approximately: • 1.615B USDT • 62.6M RLUSD • 29,934 wBETH • 11,372 XAUt • 6.19M UNI • 198.4M ENA • 7.175T PEPE • 27.8M USD1 • 2.26M LINK • 127,853 AAVE about $2.5B at the explorer’s prices. 1. The attacker deOpen on X →
History