On-chain analysts have flagged that a wallet associated with Justin Sun — the HTX Recovery address — withdrew 274 million USDT from Aave just 21 minutes after the protocol froze its rsETH and wrsETH markets on April 18, 2026. The move came in the wake of a $292 million exploit of the KelpDAO protocol, which forced Aave to take emergency containment measures.
Rapid Withdrawal Window
According to Wu Blockchain, Aave's governance froze the rsETH and wrsETH markets at 18:52 UTC on April 18. The HTX Recovery address completed its USDT withdrawal between 19:12 and 19:17 UTC — a five-minute execution window. Analysts note that such speed suggests either pre-positioned transactions or automated triggers, rather than a manual response.
The freeze was triggered by an exploit affecting the KelpDAO protocol, where an attacker exploited a vulnerability in the Layerzero bridge to drain approximately $292 million in assets. The attacker then used the stolen rsETH as collateral on Aave to borrow Ether, prompting the protocol to halt the affected markets as a containment measure.
Justin Sun has not issued a public statement regarding the withdrawal. The HTX Recovery wallet is known to be tied to Sun's exchange HTX (formerly Huobi). On-chain data provider Llamarisk later published an incident report detailing potential bad-debt scenarios for rsETH depositors.
Market Turmoil and Aave's Liquidity Crisis
In the 24 hours following the exploit, whale withdrawals from Aave exceeded $5.4 billion, pushing the protocol's ETH utilization rate to 100% and effectively locking depositor funds. The estimated bad debt from the attack ranges between $177 million and $200 million. Aave's native token AAVE dropped 17.7% in the aftermath.
This is not the first time a Sun-linked wallet has rapidly exited Aave during market stress. In March 2023, similar wallets withdrew large USDC and DAI positions from Aave during the Silicon Valley Bank de-pegging episode, sparking community criticism over potential insider positioning. The current incident has renewed debate about the level of monitoring and privilege enjoyed by large DeFi participants.
Bridging Vulnerabilities and DeFi Resilience
The KelpDAO exploit once again highlights the risks associated with cross-chain bridges and restaking protocols. KelpDAO offers liquid restaking solutions, and the Layerzero bridge vulnerability allowed an attacker to drain funds and manipulate the rsETH supply. Aave's decision to freeze the markets was a standard risk management measure, but the speed of the Sun-linked withdrawal has led to calls for better transparency and automated risk alerts for all users.
As of press time, Aave's risk service provider Llamarisk has outlined potential resolution scenarios, including socializing losses among depositors or pursuing recovery through insurance and legal channels. The broader DeFi community is closely watching how Aave and KelpDAO handle the aftermath, as the incident underscores the fragility of interconnected lending markets.