TheLawyer.klima - 0xLegal.eth

The Aave v3 position is still open on day two. An address attributed to the Binance attacker has 60,019,216.06 aUSDT supplied and 19,764.33 WETH borrowed against it, read at 14:14 UTC. In 24 hours: +10,771.38 collateral, +1.13 WETH of debt. Nothing deposited, nothing repaid, nothing withdrawn. It just accrued on both sides. The borrower's own ETH went from 0.0988 to 0.0000089. It can no longer pay for a transaction.

The FBI published 628 addresses for the Binance theft yesterday and asked exchanges, DeFi services and analytics firms to block them. They are in our data as of this morning, master and read replica. None of them is on a sanctions list. That makes them a different compliance case: an attribution by law enforcement, not a designation. A designation may well follow. Until it does, these addresses need handling of their own, not a sanctions flag.

The last issuer freeze in this case did not land where our own label set said it did. It was Circle, USDC, $123,175.53 at 04:11:35 UTC on 30 Oct, on an address a public explorer calls Exploiter 22 and we had not yet written down. So we walked one hop out from every attributed address: 185 counterparties, 35 on Ethereum, 5 on Tron. Two freezes, both on that one address.

3,984.49 ETH in a wallet with nonce 0. It has never sent a transaction, never paid gas, never tested the way out. It only receives. Today it took 747.769155 ETH more, in four transfers between 12:55 and 14:07 UTC. None of those four senders could pay for gas either, until one address gave each of them exactly 0.05 ETH first.

A second Binance hot wallet is blacklisted. Circle froze "Binance: Hot Wallet 34" on six chains in 38 seconds on 29 Oct. We re-read it at 14:26 UTC today. On Base: balanceOf 60,000,000.000978 USDC, isBlacklisted true. $62,956,105.66 across six chains, still frozen. Check any address yourself: blockchainanalysis.io/tools/…

Not all of it is circulating. One attributed address still has an Aave v3 position open: 60,008,444 aUSDT supplied, 19,763.20 WETH borrowed, read at 14:10 UTC. Tether blacklisted it at 21:02:47 yesterday; our ledger records that freeze at $0. The USDT was already in the pool.

To be clear about the gap: our number counts on-chain blacklists only. Assets held back by an exchange, a bridge or a partner never produce one, so a larger total is entirely possible. We can only measure the part that leaves a trace on the chain, and that part is $2.40B.

The frozen line is the one anyone can check, and it holds up: 65 blacklist events over the 29th and 30th, $2.46B locked, 28 of them on the attacker's own addresses for $2.40B. Counted from the issuers' on-chain events, not from a statement. That is the actual difference with 2022. The FTX hole sat in a ledger nobody outside could read. This one is public down to the dollar, including the part still moving: 488,362 ETH, 18,270 BTC, 970,554 SOL, read this morning.

People are saying the attacker's stablecoins were frozen inside Aave. That is not what happened, and the real version is more interesting. They deposited 60,004,324 USDT into Aave V3 and borrowed 19,762.89 ETH against it. Tether blacklisted the address 72 seconds after the first freeze — and caught nothing. Our ledger records that freeze at $0, because the USDT was already in the pool. The address holds aEthUSDT, not USDT. Nothing in Aave is frozen. The collateral sits in the pool, untouched, and no other user is affected. The borrower's address is blacklisted, so the deposit is stranded, not seized. A loan nobody intends to repay is not a loan. It is a sale: 60M of USDT that was about to be blacklisted, exchanged for $44.3M of ETH that cannot be. Balances read on Ethereum at 06:10 UTC today. Address attributed, not confirmed. blockchainanalysis.io/a/eth/…