Right after the Binance hot wallet hack on October 29, 2026 (UTC), in the minutes when Tether and Circle began freezing funds, the attacker deposited 60 million USDT into the lending protocol Aave as collateral and borrowed about USD 44.6 million in ETH. Lambda256 used its blockchain intelligence platform CLAIR to trace how this loan sidestepped the freeze and where the collateral went after the November 4 liquidation.

USDT deposited in Aave sits inside the Aave contract, not at the attacker's address. An issuer cannot easily freeze the attacker's share alone, and freezing the whole contract would lock other depositors' funds. The borrowed ETH has no issuer that could freeze it. The attacker never reclaimed the collateral and moved the borrowed ETH to another wallet within two minutes.

On November 4 at 14:49 UTC, half of the loan was liquidated. A liquidation bot repaid 9,884 WETH of the debt and took 24.38 million USDT of collateral. Because no transaction came from the attacker's wallet, this change does not appear in transfer records. Lambda256 confirmed it by re-checking the wallet's collateral and debt position in CLAIR.

Of the USD 5.9 billion stolen across three chains, 89% has been frozen by issuers or remains untouched in attacker wallets. Stablecoin freezes proved to be the most effective response, but the incident also showed their limit: funds inside DeFi contracts are hard to reach. The report includes fund flows by chain, a timeline, and the tracing method and scope.

Key takeaways

• Around the time the freeze began, the attacker posted 60 million USDT as collateral on Aave and borrowed about USD 44.6 million in ETH.

• USDT inside the Aave contract cannot easily be frozen for the attacker alone, and the borrowed ETH has no issuer to freeze it.

• The November 4 liquidation moved 24.38 million USDT of collateral to a third party unrelated to the incident, a change found by re-checking wallet state rather than tracing transfers.

• Of the USD 5.9 billion stolen across three chains, 89% is frozen (USD 2.58B) or held in attacker wallets (USD 2.70B). Dispersed funds total about USD 225 million on TRON.

Table of contents

• 01 Incident overview

• 02 Ethereum (Aave collateral loan, November 4 liquidation)

• 03 TRON

• 04 Bitcoin

• 05 Tracing method

• 06 Scope and basis

Footnote

Figures are as of 17:00 KST, November 5, 2026, and may change. Stolen amounts cover Ethereum, Bitcoin and TRON only. This report presents Lambda256's analysis of public onchain data using CLAIR and is provided for informational purposes only. Lambda256 makes no representation as to its accuracy or completeness, and it does not constitute an official statement or finding by any law enforcement agency, legal advice or investment advice. Interpretations are Lambda256's assessment based on confirmed transaction records, and the report does not address attribution.