An attacker deposited 60 million USDT as collateral and borrowed about $44.6 million in ETH from Aave.

How the scheme worked

The assailant supplied stolen stablecoins to Aave pools as collateral, then took out a large loan denominated in ETH and withdrew the borrowed tokens.

Because Tether can freeze USDT balances but ETH lacks a central issuer with such authority, the attacker kept the borrowed ETH out of reach.

Collateral mechanics and risk distribution

After deposit, the stablecoins reside in Aave’s collective liquidity pool, so freezing the attacker’s wallet would not recover those funds from the pool itself.

Freezing an entire pool would affect other users, so protocol operators face a trade-off between targeted freezes and broader disruption.

• The collateral left on Aave totals about 60 million USDT, covering the approximate $44.6 million debt.
• According to LlamaRisk, at the time of assessment there was no immediate threat to depositors from the position.

If the collateral value approaches protocol liquidation thresholds, third parties can repay portions of the loan and claim corresponding collateral without requiring the attacker’s consent.

Aave’s response

To prevent repetition using other stolen assets, Aave temporarily restricted new deposits and borrow operations while allowing withdrawals and loan repayments to continue functioning.

The protocol’s measures aim to limit issuance of fresh credit against potentially tainted collateral while preserving normal exit options for legitimate users.