On-chain analysts have flagged that a wallet associated with Justin Sun withdrew 274 million USDT from Aave only 21 minutes after the protocol froze its rsETH market on April 18, 2026. The move came in the wake of the KelpDAO exploit, which drained approximately $292 million from the protocol and forced Aave to halt trading in related assets.
The 21-Minute Window: Pre-Set or Reactive?
The wallet in question, identified as the HTX Recovery address linked to Justin Sun's exchange HTX, initiated the withdrawal after Aave's rsETH and wrsETH markets were frozen at 18:52 UTC. The 274 million USDT was moved between 19:12 and 19:17 UTC — a five-minute execution window that analysts describe as indicative of a pre-programmed or automated trigger, rather than a manual response to the breaking news.
The market freeze was triggered by the KelpDAO exploit, where an attacker used a vulnerability in the Layerzero bridge to siphon approximately $292 million. The stolen rsETH was then used as collateral on Aave to borrow ETH, prompting the protocol to freeze affected markets to limit further risk.
Whale Exodus and Aave's Liquidity Crunch
Sun's withdrawal was part of a larger wave of capital flight. According to data from Wu Blockchain and Lookonchain, whales pulled over 5.4 billion ETH from Aave within 24 hours of the exploit, pushing the protocol's ETH utilization rate to 100% and effectively locking in remaining depositors. Aave's risk service provider Llamarisk later published a report estimating bad debts between $177 million and $200 million for rsETH depositors.
The 274 million USDT exit was one of the largest single withdrawals from Aave during the event window, fueling further panic. The AAVE token price dropped 17.7% in the aftermath.
Justin Sun's History of Rapid DeFi Moves
This is not the first time Sun has moved large DeFi positions during market stress. In March 2023, during the Silicon Valley Bank de-pegging event, wallets linked to him shifted significant USDC and DAI holdings from Aave, drawing widespread community scrutiny. The latest incident has reignited debates about insider knowledge and the effectiveness of DeFi's risk notification systems.
As of press time, Justin Sun has not publicly commented on the withdrawal. Analysts note that the 21-minute gap between the freeze and the exit underscores the challenge DeFi platforms face in balancing timely user alerts with market fairness.