The introduction of Aave market freezes drew scrutiny after a social media post stated that an attacker linked to Binance deposited $60 million in stolen USDT and borrowed approximately 19,762 ETH before the market freezes took effect.
Emilio, in a post on X, stated that the intervention was aimed at preventing attackers from using Aave deposits to complicate the asset recovery process. His explanation addressed concerns that freezing the markets would itself signal a problem for the lending protocol.
“It’s just a precautionary measure,” he wrote, explaining that lowering borrowing limits to zero would have halted borrowing entirely.
However, according to him, leaving deposits open would have preserved another avenue for attackers to move stolen assets into the protocol. The market freeze was intended to cut off that avenue while asset issuers worked on recovering funds.
In his explanation, Emilio distinguished between halting new loans and halting new deposits. A zero borrowing limit addresses the first issue, but his post stated that attackers could still supply assets if the markets remained open to deposits.
He argued that allowing those deposits could make it harder for asset issuers to seize the stolen funds. The stated purpose of the freeze was therefore to support recovery efforts by restricting further use of the affected markets.
His post did not identify the affected markets, did not specify the size of any affected positions, and did not announce any loss allocation. It described the reasons for imposing the restrictions but did not indicate a timeline for lifting them.
The intervention came amid a separate discussion about whether the attacker had already used Aave to obtain ETH using stolen stablecoins.
In a post on X, a commentator known as nug stated that the attacker who targeted Binance deposited $60 million in stolen USDT into an Aave account minutes before the freezes took effect.
The post said the attacker used the deposit as collateral to borrow approximately 19,762 ETH and then transferred the borrowed cryptocurrency.
According to the transaction description in the post, the attacker kept the liquid ETH, leaving the USDT backing the loan inside Aave. The author characterized the position as overcollateralized and argued that the borrower had little incentive to repay voluntarily.
The post also claimed that blacklisting the attacker’s wallet would no longer affect the USDT already deposited in the Aave contract. This situation was contrasted with the borrowed ETH, which was described as having no issuer capable of freezing it.
These claims were the commentator’s explanation of the alleged exit route. Neither Emilio’s post nor the transaction report stated that Aave had written off the loan, booked a shortfall, or assigned losses to depositors.
