MARKET EVENT
A $6.36B Binance hack triggered market-wide liquidity stress, but Sentora’s vaults remained fully solvent, met all redemptions, and recorded no bad debt or depositor losses.
On 29 October 2026 an attacker drained about $6.36 billion from Binance hot wallets on ten chains, starting at 20:05 UTC. Sentora had no direct exposure to Binance and effects on Sentora’s vaults were minor and indirect, through market-wide effects: higher depositor redemptions, all met in full; the Aave market freeze; and brief price dislocations in USDe and RLUSD that recovered within hours.
Both of Sentora's main Morpho vaults met every redemption. There was one liquidation in Sentora-curated markets, of about $35k, and no bad debt. No supervised position by Sentora was liquidated.
What happened
Between 20:05 and 20:22 UTC, wallets on XRP, Solana, Optimism, Bitcoin (18,270 BTC) and Tron were drained by signed transfers. On Ethereum, a pre-signed EIP-7702 delegation turned a Binance hot wallet (Binance 14) into an attacker-controlled sweeper. The main sweep followed at 20:24 UTC and took 167,464 ETH, 1.615 billion USDT and about 65 other tokens.
The attacker moved fast to convert what issuers could freeze. Between 20:30 and 20:59 UTC, 325 million USDT was sold for about 122,300 ETH through RFQ fillers at a discount above 10%. At 20:57 the attacker supplied 60 million USDT to Aave V3 and borrowed 19,762 WETH.
Issuers responded within 37 to 41 minutes of the main sweep. Tether blacklisted the collector wallet at 21:01, Circle froze 823 million USDC at 21:04, and Ripple froze 40.5 million RLUSD at 22:01. Aave froze all DAO-run V3 and V4 markets at 22:05, and a second attack wave hit Avalanche and Polygon at 23:05. Binance 14 revoked the EIP-7702 delegation at 00:10 UTC on 30 October.
The speed of the issuer freezes is why most of the stolen stablecoins were caught, and why none of the BTC or ETH was.
Where the funds went
As of 08:09 UTC on 30 October, about $2.8 billion of the stolen funds is frozen or seized. About $3.2 billion is free to move, almost all of it in BTC, ETH, XRP, TRX and SOL that no issuer can touch. The attacker converted about $880 million into ETH and TRX before the freezes landed.
Of the 1.875 billion USDT taken on Ethereum, about 435 million was sold before Tether's blacklist, 1.38 billion is frozen, and 60 million is trapped as Aave collateral.
How Sentora's vaults held up
Sentora's two main Morpho vaults saw 11% to 13% of withdrawals in six hours, took one $35k liquidation and no bad debt, and met every withdrawal. The strain showed in liquidity, not in losses.
Vault | Flows, 29 Oct 20:00 to 30 Oct 08:00 UTC | Total assets |
Sentora RLUSD Main | $50.5M redeemed | $439.5M to $389.3M |
Sentora PYUSD Main | $65.2M redeemed, $17.4M deposited | $359.2M to $311.3M |
Redemptions started at 20:00 UTC and peaked at $21.7M an hour for RLUSD Main (01:00 UTC) and $26.5M for PYUSD Main (22:00 UTC). Before the event, neither vault had seen more than $0.5M of withdrawals in any hour since 28 October. The vaults reallocated out of markets near full utilisation to keep withdrawals flowing, and ended the night with about 5% idle and 89% to 95% utilisation across their markets.
Median borrower health factors on BTC and ETH collateral fell by 0.04 to 0.05 at the low and recovered as prices did. Stablecoin-collateral markets (sUSDe, syrupUSDC) stayed at their usual median of about 1.05. No borrower went under water.
The one liquidation hit the RLUSD/USDe market at 00:16:47 UTC on 30 October: about 35,230 RLUSD repaid and 36,355 USDe seized. Supervised positions by Sentora were rebalanced to their target health factors overnight.
Oracle performance
Every Chainlink feed behind Sentora's markets updated within its published heartbeat and deviation settings, and the markets stayed solvent through the move. BTC/USD and ETH/USD tracked the drop in real time, with 62 and 132 deviation-driven updates. The two slower feeds, cbBTC/USD and USDe/USD, lagged the market within their design bands, and the lag did not cause a single bad-debt event.
cbBTC/USD (24-hour heartbeat, 2% deviation) held 79,853 from 20:37 to 23:43 UTC while BTC/USD fell to about 78,237, a gap of about 2.0% at the low. The 23:43 update landed on the 2% trigger, as designed.
USDe/USD (23-hour heartbeat, 0.5% deviation) held 0.99969 until 00:16:47 UTC on 30 October, then printed 0.9944 on its 0.5% deviation trigger, its first update in about 16 hours. The one liquidation in Sentora's markets came in that same second. At 01:00 and 02:00 UTC, when large DEX trades cleared near 0.93, the feed still showed 0.9944, so it lagged the market for those hours rather than tracking it. Prices were back near 0.998 from 03:00 UTC. At the DEX low, the collateral in the RLUSD/USDe market was worth about $3.1M (6.5%) less than the feed implied, and the market remained fully covered once prices recovered. No bad debt resulted.
Sentora uses a Chainlink market-price feed for USDe rather than a hardcoded $1, so that lenders are protected if USDe trades below par for a sustained period. This event tested the other side of that choice.
The contagion
No issuer Sentora's markets depend on took a loss, no lending market Sentora allocates to took bad debt, and no major stablecoin depegged on-chain. The impact was tight liquidity across venues, driven by high utilisation in markets and by venues temporarily frozen to mitigate risk.
On the issuer side, 9.7M USDe was taken and sold; Ethena states it had no exposure, with collateral held off-exchange, and the price recovered by 03:00 UTC. Of 88.5M RLUSD taken, about 48M was sold on DEXs, pushing one pool to 0.96, and RLUSD was back at $1 on Curve by 03:45 UTC. Maple and Sky/Spark had no direct exposure. Tether, Circle, World Liberty and Paxos froze 1.77B USDT, 825M USDC, 27.8M USD1, and PAXG and XAUt.
On the venue side, Aave froze 175 V3 reserves on 16 networks and all 48 V4 Core Hub reserves, pushing USDG utilisation from 69% to 99.5%. The attacker still holds 60M USDT on Aave V3 against 19,762 WETH of debt at a health factor of 1.06; because blacklisted collateral may not transfer, this is an untested bad-debt path. Kamino paused borrowing in its SOL/BTC market, with main-market stablecoin utilisation at 87% to 99%. Morpho Blue saw no bad-debt liquidation in any market since 28 October.
Sentora is watching four things: sales from the attacker's unfreezable BTC and ETH, which are the main remaining price channel into BTC and ETH collateral; the timing of the Aave unfreeze and its effect on utilisation and rates; any wBETH redemption delay; and the treatment of freezable stablecoin collateral in liquidation paths.
What this means
A $6.36 billion exchange hack reached Sentora's vaults only as a liquidity event. Redemptions were met, oracles behaved as designed, and no borrower or depositor took a loss. Issuer freezes of DeFi-held collateral are now a live consideration for lending-market design.
Sentora is reviewing:
Health-factor floors for supervised positions set by collateral liquidity class, so that positions backed by less liquid collateral carry a larger cushion.
Per-market oracle settings, including whether the 0.5% band and 23-hour heartbeat remain right for a 91.5% loan-to-value USDe market, and whether cbBTC markets should move to the BTC/USD feed plus an exchange-rate feed.
Monitoring redundancy, with alerts that trigger directly from health-factor thresholds.