Aave market freezes draw scrutiny over claimed $60M hacker loan

Aave’s market freezes have drawn scrutiny after a social media post claimed a Binance-linked attacker deposited $60 million in stolen USDT and borrowed roughly 19,762 ETH before issuer freezes took effect.

Emilio, posting on X, said the intervention was intended to prevent attackers from using Aave deposits to complicate asset recovery. His explanation addressed concerns that the frozen markets themselves signaled a problem for the lending protocol.

“It’s just a precautionary measure,” he wrote, explaining that dropping borrow caps to zero could have been sufficient to disable borrowing.

Leaving deposits open, however, would have preserved another route for attackers to move stolen assets into the protocol, he said. Freezing the markets was intended to close that route while asset issuers pursued the funds.

Aave freezes were described as a recovery measure

Emilio’s explanation distinguishes between stopping new loans and stopping new deposits. A zero borrow cap addresses the first activity, but his post said attackers could still supply assets if the markets remained open to deposits.

He argued that allowing those deposits could make it harder for asset issuers to seize stolen funds. The stated purpose of the freeze was therefore to support recovery efforts by limiting further use of the affected markets.

His post did not identify the markets involved, specify the size of any affected positions, or announce a loss allocation. It described the reasoning behind the restrictions without setting out a timetable for removing them.

The intervention became part of a separate discussion about whether an attacker had already used Aave to obtain ETH against stolen stablecoins.

The $60 million USDT claim centers on borrowed ETH

In a post on X, the commentator known as nug claimed the Binance attacker deposited $60 million in stolen USDT into Aave minutes before freezes took effect.

The account said the attacker used the deposit as collateral to borrow roughly 19,762 ETH, then moved the borrowed cryptocurrency away.

According to the post’s account of the transaction, the attacker retained liquid ETH while leaving the USDT backing the loan inside Aave. The author described the position as overcollateralized and argued that the borrower had little reason to repay voluntarily.

The post further claimed that blacklisting the attacker’s wallet would no longer affect USDT already deposited in Aave’s contract. It contrasted that situation with the borrowed ETH, which it described as having no issuer capable of freezing it.

Those statements were the commentator’s explanation of the claimed escape route. Neither Emilio’s post nor the transaction account announced that Aave had written off the loan, recorded a shortfall or assigned a loss to depositors.

Morpho’s Paul Frambot defends isolated markets

The discussion expanded into a dispute over lending architecture after Morpho’s Paul Frambot published a message about risk management during the industry disruption.

Frambot said Morpho was deliberately built around isolated markets, allowing users to choose which markets they are exposed to. In his description, a problem in one market does not spread automatically to the others.

He said collateral reuse was optional and that counterparty exposure could be controlled. Optional permissioning, including on Midnight or through vaults, lets participants define who can lend and borrow, he wrote.

“None of this eliminates risk entirely,” Frambot said.

He acknowledged that individual markets could experience liquidity constraints and interest-rate volatility as decentralized finance absorbed the shock. His defense focused on containing problems within individual markets, while recognizing that participants in those markets could still face disruption.

Marc Zeller challenges Morpho’s emergency protections

Responding to Frambot, Marc Zeller argued that Morpho Blue’s design leaves it without several tools available in Aave’s approach.

Zeller said a Morpho Blue market cannot freeze activity, intervene in its interest-rate curve, or implement rate limiting. He further pointed to the absence of an Umbrella junior tranche to protect deposits.

In his criticism, isolation does not remove the losses suffered inside a failed market.

“When an isolated market breaks, its lenders take 100% of the loss,” Zeller wrote.

He cited the Stream and Elixir vault disruptions when criticizing support for affected users. Zeller further claimed Morpho had added roughly $2.15 billion in active loans during the year, comparing that figure with lending activity he attributed to the Plasma launch.