Late on Oct. 30, Binance co-founder Yi He said the hacker’s 60 million USDT collateral position on Aave was not fully frozen. And, in her telling, the attacker actually got away with only $46 million in ETH. She added that another $14 million could still be recovered once the related assets are released through law enforcement channels.
Yi He comments on the Aave position
Yi He said this in a reply on X at 6:27 p.m. on Oct. 30. She was answering a post from X user @sciencedegens, published at 5:54 p.m., that pointed to Changpeng Zhao’s estimate that more than $6 billion had been stolen and roughly $3 billion had been frozen.
The user’s argument was pretty direct: that frozen $3 billion was, in practice, USDT supplied by protocol lenders, because the hacker first put up USDT as collateral and then borrowed ETH against it. Under that reading, freezing the margin inside lending protocols could set off on-chain liquidations.
Yi He did not spell out what she meant when she said the Aave collateral was not under a full freeze. She also gave no details on how those assets would be released through the law enforcement system.
In her post, Yi He wrote: "Thanks for the attention. At present, the 60 million U pledged on AAVE is not within the scope of a complete freeze. The hacker actually only took 46M of ETH. After this portion is unlocked through the law enforcement system, another 14M in recoverable coins can be retrieved."
On-chain data shows 19,762 ETH was borrowed
Based on BlockTempo’s check of on-chain records, hacker address 0x8d53 deposited 60 million USDT into Aave in two transactions at around 5 a.m. on Oct. 30. Then the same address borrowed 19,762 ETH.
Aave contract data viewed at 7:13 p.m. showed the position carrying about $59.94 million in collateral and about $44.28 million in debt. The report said that debt number was based on an ETH oracle price of around $2,241.
So the spread between collateral and borrowed funds comes to about $15.66 million. Yi He’s $46 million figure is roughly $1.7 million above the debt shown in the contract data, though she did not say what price reference she was using.
Health factor stood near 1.056
The report said Yi He’s $14 million number lines up with the difference between $60 million and $46 million. But if you go by the contract’s collateral and debt values, the gap comes out to about $15.66 million.
The position’s health factor sat at about 1.056. That’s the metric used to judge whether the collateral can still cover the debt. If it drops below 1, liquidation becomes possible. The report said that would happen if ETH climbed to about $2,366.
BlockTempo also said that when it checked the position at 9:52 a.m., the health factor was 1.077 and the remaining borrowing capacity was 0. Meaning the hacker could not withdraw the pledged USDT at that point.
Aave halted new deposits and new borrowing
The report also said Aave froze its V3 and V4 markets at 6:44 a.m. on Oct. 30. But not everything stopped. Only new deposits and new borrowing were paused. Withdrawals and repayments were still open.
At 6:55 p.m., Binance said it had reserved more than $6.34 billion of company funds to cover losses. That total does not include assets that had already been frozen or otherwise protected. The exchange also said it was working with partners and law enforcement agencies to recover about $3 billion in frozen assets.
