Ethereum (ETH) Arbitrageur Nets $3.47M From Aave Oracle Gap After Binance Hack

One Address Cleared $3.47 Million in Two Hours

Roughly $3.47 million in arbitrage profit now rests in a single Ethereum (ETH) address, the end point of a two-hour trade that worked the gap between the Ethereum price on decentralized exchanges and the level Aave's oracle reported. The address, which starts 0x0cdd and ends 61D8, placed its first borrow just 24 minutes after Binance's hot wallet was hacked at 04:24 (UTC+8) on Friday, October 30, and completed 18 borrow rounds by 05:32. On-chain analysis posted on X by community user 0xNaiXi reconstructs the full sequence, and the explorer record for the address matches it. Holding a large stash of USDT and racing to swap it before Tether could freeze the tokens, the hacker bought ETH in volume on Uniswap, an automated market maker that prices trades from its own pooled liquidity. Binance had suspended withdrawals at the same time, so cheaper ETH sitting on the exchange could not be moved on-chain to close the gap. Between 04:40 and 05:40, Ethereum (ETH) on Uniswap was bid up to $2,560 to $2,750, with individual fills above $3,000, while the Chainlink oracle Aave relies on, a service that feeds off-chain exchange quotes into the smart contract, stayed pinned between $2,250 and $2,290. The spread ran 15% to 30% and held for nearly an hour. The most profitable address worked it in three steps: deposit USDC or USDT into Aave as collateral, borrow ETH at the oracle price near $2,280, and sell it on decentralized exchanges above $2,600, routing each sale through the 0x aggregator in clips of roughly 300 to 1,000 coins. Stablecoins from each sale went back into Aave as fresh collateral, and the cycle repeated 18 times. Once DEX prices fell back near $2,290, the address bought back 12,314 ETH at an average of about $2,297 and repaid the loans; it had sold 12,289 ETH at an average near $2,580. About $283 per coin between the two legs, across more than 12,000 coins, produced the $3.47 million.

61 Borrowers, $6.36 Million in Gains

The profit tally stretches well beyond one address. Within six hours of the incident, 61 addresses had borrowed Ethereum (ETH) on Aave's main market, and the top ten of them combined for roughly $6.36 million in gains before costs. The second-best address took about $780,000, and the third through fifth earned roughly $670,000, $430,000 and $290,000. Across 206 sell orders logged in the window, the average fill printed 10% above the oracle price, and the best prints cleared 30% above it. The same loop funded most of the smaller profits: borrow against the oracle, sell into the premium, wait for the premium to die. The attacker's own borrowing sits outside those figures: on-chain data shows the hacker posted 60 million USDT as collateral and borrowed 19,762 ETH directly from Aave, deepening the drain before the protocol intervened. For Ethereum markets, it amounted to one of the sharpest hourly dislocations in memory, compressed into a single Friday-morning window. The window was already narrowing as the morning went on. After 05:30 the spread compressed to 3% to 5%, and Aave froze its V3 and V4 markets at 06:44, after which latecomers could no longer borrow ETH at all. The freeze kept withdrawals and loan repayments open, so existing positions could still be unwound. Every gain in the tally is valued at $2,280 per ETH and excludes the gas fee each transaction paid, so realized profits run somewhat lower. Borrowed positions carried their own risk: a short ETH position loses as the price rises and the borrower's health factor falls with it, which is why the largest operators worked in small batches instead of one trade. Spreads of this size normally collapse within seconds as traders compete them away; this one survived close to an hour because Binance's withdrawal pause kept exchange-priced liquidity off the chain.

Why the Gap Lasted Nearly an Hour

COINOTAG's reading: nothing here points to a fault in Aave. The lending contracts priced borrows exactly as configured, and the analyst who compiled the data reaches the same conclusion. The dislocation came from Binance's withdrawal pause, which severed the route by which exchange-priced ETH would normally arbitrage such a gap shut within seconds. A Chainlink feed that aggregates exchange quotes could not see the on-chain bidding, so borrowers could mint ETH near $2,280 and sell it above $2,600. Our live monitoring shows spot ETH about 3.4% lower over the past 24 hours, back within the range the oracle held all morning. As of the explorer's latest record on Friday, the $3.47 million still sits with the 0x0cdd address.