The Binance hacker pre-empted among the business’s potential reactions and deliberate countermeasures, together with utilizing Aave and UniswapX to keep away from seizures and fund freezes.
On Thursday, the attacker, now confirmed as North Korea’s TraderTraitor, made an preliminary $3.79B sweep on the Ethereum community, together with 200,630 ETH and a few stablecoins.
Knowing that Tether, Circle, and different platforms would transfer rapidly to freeze the stablecoins and different property, the attacker deposited $60M USDT on Aave and borrowed out 19,760 WETH ($45.13M). This occurred between 20:58 UTC and 21:01 UTC on Thursday, twenty ninth October.
Similarly, TraderTraitor swapped $325M USDT utilizing UniswapX and Iinch between 21:34 UTC and 21:09 UTC.
In truth, analysts observed that the hacker was pressured to pay 10% of their swapped quantity to fast-track the orders earlier than freezing started. The UniswapX transfers took about 35 minutes, whereas Aave borrowing took solely 5 minutes. Subsequently, the hacker unwrapped the WETH and received the native, unfreezable 142,062 ETH.
Tether and Circle started the freezes by round 21:18 UTC, stopping additional conversions. However, the attacker now had 420K ETH (unwrapped 142K ETH, authentic 200K ETH from Binance wallets, and different swapped non-USDT property).
Commenting on the unlucky however huge scheme, one analyst stated,
The Binance hacker might need simply pulled off one of many smartest strikes I’ve seen in crypto. Tether can freeze the USDT sitting within the pockets. But it might probably’t freeze the ETH he already borrowed.
He added,
So now Aave is left holding frozen collateral, whereas the hacker is sitting on liquid ETH.
Aave denies dangerous debt claims after Binance hack
Here, it’s value noting that the KelpDAO hack leveraged an analogous DeFi lending loophole to money out and launder stolen funds. Aave was left with over $120M in dangerous debt.
However, Aave founder Stani Kulechov denied that dangerous debt claims had been relevant to the Binance hack incident.
Actually, there isn’t any dangerous debt, in actual fact, it’s over-collateralized with steady collateral. Kelp was completely different.
What stays unclear, nonetheless, is who will probably be repaid the $60M: Is it Binance, the first sufferer, or Aave, which can be a secondary sufferer?
In truth, some have even puzzled how over $1M was allowed to be signed off with out human evaluation, not to mention $325M swept from a few of Binance’s scorching wallets. For centralized exchanges reminiscent of Binance, caps make sense. However, for non-custodial decentralized platforms, it’s a special setup that’s designed to haven’t any human intervention.
According to Chainalysis, platforms working the wallets on Ethereum with the bug that the attacker used ought to now be vigilant and improve accordingly.
Final Summary
- Binance hacker used Aave and UniswapX to swap $365M USDT to unfreezable +120K ETH.
- Aave denied claims that the incident left it with dangerous debt just like the KelpDAO exploit.
