A 10 million USDT deposit at 20:57:59 UTC on October 29 was followed by a 3,271 WETH borrow just 72 seconds later, according to forensic timestamps published to Aave’s governance forum A sepa
A forum post published to Aave’s governance site on November 13, 2026 at 12:49 AM and 6:41 AM UTC lays out detailed, second-by-second forensic timestamps drawn from the October 29, 2026 Binance hot-wallet security incident, submitted as supporting evidence within an ongoing community debate over new preventive risk controls. The post, from community member SrAugust, was contributed to a temperature-check thread originally opened November 9 proposing what the thread calls an “AAVE Security Shield,” a feasibility study into borrowing-velocity circuit breakers for the protocol.
The forensic detail itself is striking in its precision. The post documents a 10 million USDT deposit landing at 20:57:59 UTC, followed by a 3,271 WETH borrow against that collateral just 72 seconds later, at 20:59:11 UTC. A second, larger sequence shows a 50 million USDT deposit at 21:00:59 UTC followed by a 16,491 WETH borrow only 48 seconds after that. Combined, the two sequences account for roughly 19,762 WETH borrowed within minutes of the underlying collateral deposits arriving.
Perhaps the most significant single data point in the post is the concentration of that borrowing: 83% of the total WETH amount was borrowed in a single transaction occurring approximately 8 minutes after the funds first landed on the protocol. That degree of speed and concentration, the post argues, is a pattern far more consistent with an attacker rapidly cycling stolen funds through a lending market than with ordinary, organic borrowing behavior.
The data is being used within the thread to argue in favor of a “gradual credit enablement” mechanism, under which freshly deposited collateral would only unlock its full borrowing power gradually over time rather than immediately, specifically to blunt this kind of rapid-fire deposit-then-borrow pattern. The broader temperature-check thread remains in the discussion stage rather than having advanced to a formal vote, with community members continuing to debate the right balance between added friction for legitimate borrowers and protection against this specific attack pattern.
The episode illustrates how major DeFi protocols are increasingly treating a single high-profile hack, even one that did not directly target their own code, as a detailed case study for hardening their own risk controls against similar attack patterns in the future. The full forum thread is published on Aave’s governance forum.
This post first appeared in Aave Forum Post Breaks Down the Exact Seconds Between Deposit and Borrow in the Binance Hack
