Onchain Analysts Flag Justin Sun-Linked Wallet’s 274 Million USDT Exit From Aave Minutes After rsETH Freeze

Key Takeaways:

• A wallet linked to Justin Sun pulled 274 million USDT from Aave 21 minutes after the rsETH market was frozen.
• The withdrawal coincided with KelpDAO’s 292 million exploit on April 18, which forced Aave to halt rsETH markets.
• Sun has not responded; onchain analysts say the 21-minute window raises questions about decentralized finance ( DeFi) position monitoring.

A Swift Exit From Aave Puts Justin Sun Back Under the Microscope

The wallet in question is the HTX Recovery address, an onchain account associated with Sun’s exchange HTX. According to Wu Blockchain, Aave’s rsETH and wrsETH markets were frozen at 18:52 UTC on April 18. The 274 million USDT withdrawal was completed between 19:12 and 19:17 UTC, a five-minute execution window analysts say suggests pre-positioned transactions or automated triggers.

The rsETH market freeze was triggered by the KelpDAO exploit, in which an attacker drained approximately 292 million from the protocol via a Layerzero bridge vulnerability. The attacker used stolen rsETH as collateral on Aave to borrow ether, prompting the protocol to freeze the affected markets as a containment measure.

Wu Blockchain described the HTX Recovery wallet’s exit as “swift,” noting the withdrawal came within the 21-minute window between the freeze and the transaction timestamp. Whether the move was a response to the unfolding exploit, a reaction to the freeze notification, or routine portfolio risk management has not been established. Sun has not issued a public statement.

In the 24 hours following the exploit, whales pulled more than 5.4 billion from Aave, pushing the protocol’s ETH utilization rate to 100% and effectively trapping remaining depositors’ funds, according to data flagged by Wu Blockchain and Lookonchain.

Sun has previously moved large DeFi positions during periods of market stress. In March 2023, wallets attributed to him shifted significant USDC and DAI holdings off Aave during the Silicon Valley Bank depegging episode, drawing intense scrutiny from the community.

The 274 million USDT withdrawal stands as one of the largest single exits from Aave recorded during the April 18 incident window. Aave’s risk service provider Llamarisk has since published a formal incident report detailing potential bad debt scenarios for rsETH depositors.