@LlamaRisk could you clarify what residual risk justified the broad freeze after Tether and Circle had already blacklisted the aggregation wallet of binance attacker, and why the existing supply/borrow limits were insufficient to contain it?
The onchain mainnet sequence I am looking at is below. All times are UTC on 29 October 2026; each event links to its transaction.
Before the first Aave deposit at 20:57:59, the traced routes had sold approximately 274 M USDT for ETH/WETH. Here is a timeline I generated by observing onchain txns (links at the end of the post).
Above transactions I feel are evidence that obtaining ETH using freezable USDT was an early priority for the attacker. Avoiding issuer freezes is probably what the attacker was trying to do first before dumping other assets. First they went for swaps, and when slippage became significant where borrowing made better sense, they started targeting Aave with the intent of dumping freezable assets ASAP.
The first V3 Core batch followed the aggregation-wallet Tether and Circle blacklists by 45m48s and 42m24s, respectively.
I understand the rationale already given, ie. alternative collateral routes remained possible, and reversing cap cuts would have taken longer than reversing a freeze. Risk stewards action post also quantifies the later removal of about $3.7B of unused V3 borrow capacity and $130M on V4. Those are useful answers about coverage and controls.
My narrower question is how much of the remaining capacity the attacker could actually access after issuer freeze, and what outcome made that exposure unacceptable?.
Unused protocol capacity is not necessarily executable attacker borrowing.
If possible, could you expand on three below points about risk management decisions in the war room? While the actions are clear, what is not clear is what data led to those actions..
1. Residual capacity: After accounting for issuer-frozen balances, what usable collateral did you estimate remained at the initial freeze decision and execution times? How much additional borrowing could it support within the applicable collateral parameters, caps and available liquidity? Risk Steward Actions quantifies unused capacity removed, I am asking about the portion accessible to the attacker.
2. Risk beyond existing controls: For the residual assets unaffected by the issuer blacklists, why was allowing markets to continue operating under their existing supply caps, borrow caps and collateral parameters considered unsafe? Did the team identify an exposure those controls could not adequately contain, or was the broad freeze a precaution because that exposure could not be assessed quickly enough?
3. Timing and scope: When were the issuer blacklists incorporated into the assessment? What made blocking new supply necessary alongside restricting borrowing, and what subsequently enabled reopening: better information about remaining funds, implementation of tighter controls, or both?
Transaction links
| Time | Block | Event |
|—|—:|—|
| 20:36:11 | 26,300,829 | [Attacker route swaps 100M USDT for ETH](Ethereum Transaction Hash: 0x4fa182626c... | Etherscan) |
| 20:57:59 | 26,300,936 | [First Aave deposit: 10M USDT](Ethereum Transaction Hash: 0x420e740153... | Etherscan) |
| 20:59:11 | 26,300,942 | [First Aave borrow: 3,271.43 WETH](Ethereum Transaction Hash: 0x01b3406c2b... | Etherscan) |
| 21:00:11 | 26,300,947 | [Second Aave deposit: 50M USDT](Ethereum Transaction Hash: 0x65bd82f199... | Etherscan) |
| 21:00:59 | 26,300,951 | [Second Aave borrow: 16,490.99 WETH](Ethereum Transaction Hash: 0xa85ad4807b... | Etherscan) |
| 21:01:35 | 26,300,954 | [Tether blacklists aggregation wallet](Ethereum Transaction Hash: 0x7baba48207... | Etherscan) |
| 21:04:59 | 26,300,971 | [Circle blacklists aggregation wallet](Ethereum Transaction Hash: 0xc954c86f11... | Etherscan) |
| 21:42:11 | 26,301,157 | [Aave V4 Ethereum Guardian freeze execution](Ethereum Transaction Hash: 0x2d144463f6... | Etherscan) |
| 21:47:23 | 26,301,183 | [First Aave V3 Core freeze batch](Ethereum Transaction Hash: 0x405bee93de... | Etherscan) |
[100M USDT through 1inch](Ethereum Transaction Hash: 0x4fa182626c... | Etherscan), followed by [50M USDT](Ethereum Transaction Hash: 0xfa949551ee... | Etherscan), [75M USDT](Ethereum Transaction Hash: 0xa861a556b7... | Etherscan), [15M USDT](Ethereum Transaction Hash: 0xe5ccc3a8b3... | Etherscan) and [5M](https://etherscan.io/tx/0x7b0ad8b5814a048086dab1236284e677e430cac142c84ab6bbbc985da1f282e6) through 0x routes. The cluster also [supplied 28.6M USDT to Compound to borrow WETH at 20:49:35](Ethereum Transaction Hash: 0x3fd5ec345e... | Etherscan). Aave then provided another route: 60M USDT collateral against approximately 19,762.41 WETH borrowed.
Core batches executed at [21:48:59]( Ethereum Transaction Hash: 0x67dce7f17a... | Etherscan ) and [21:49:59](Ethereum Transaction Hash: 0xe0ba846606... | Etherscan).