Justin Sun-linked wallet withdrew $274M from Aave after rsETH freeze

A wallet linked to Justin Sun withdrew $274 million in USDT from the Aave lending protocol shortly after Aave froze its rsETH markets on April 18. The market halt occurred at 18:52 UTC and the withdrawal was executed between 19:12 and 19:17 UTC.

Onchain analysts identified the account as the HTX Recovery wallet, an address associated with Sun’s exchange HTX. The rsETH and wrsETH markets were frozen as a containment measure after an attacker exploited a LayerZero bridge vulnerability to drain about $292 million from KelpDAO.

The attacker moved stolen rsETH into Aave as collateral and borrowed ether, prompting the protocol to lock the affected markets. The $274 million USDT exit took place 21 minutes after the freeze and was completed in about five minutes. Analysts noted the speed of the transaction is consistent with pre-positioned orders or automated triggers, though no definitive cause has been established.

It is not clear whether the withdrawal was a response to the exploit, a reaction to the market freeze notification, or routine portfolio risk management. Justin Sun has not issued a public comment.

Data flagged by onchain observers shows that in the 24 hours after the KelpDAO exploit, large holders withdrew more than $5.4 billion from Aave. Those outflows drove Aave’s ether utilization rate to 100%, which temporarily prevented remaining depositors from withdrawing ETH until liquidity was restored or positions were rebalanced.

Aave’s risk service provider, Llamarisk, published an incident report outlining potential bad-debt scenarios for rsETH depositors and detailing the protocol’s response options. The $274 million withdrawal is among the largest single exits recorded during the April 18 incident window.

Wallet movements linked to Sun have attracted attention in prior market stress events. In March 2023, addresses attributed to him removed significant USDC and DAI holdings from Aave during a period of market strain related to a bank depegging episode.

Aave teams, security analysts and onchain researchers are tracing the flow of funds tied to the KelpDAO exploit and the subsequent large withdrawals as they assess exposure and potential losses.