Blockaid has warned that flash loans exceeding $1 billion could expose financial institutions to money laundering and sanctions risks after an attacker used Aave lending markets to finance a September exploit that drained about $250,000 from Balancer V1.
In an October 22 post on X, the security firm said the incident exposed weaknesses in compliance systems that monitor account balances rather than track how funds move between wallets.
How the Balancer-Aave Attack Worked
On September 6, the attacker borrowed more than $1 billion through flash loans and used the funds as collateral across three Aave V3 markets. This enabled additional borrowing of $788 million before the attacker exploited Balancer V1 and repaid the loans within the same transactions.
Related: CoinDCX Denies New Security Breach After $16M USDT Transfer Alert
Because the funds were returned before the transactions ended, balance-based checks could miss the activity. Aave suffered no direct losses.
Blockaid Calls for Real-Time Monitoring
Blockaid said it flagged the attacker’s address hours before the exploit after tracing its funding to Tornado Cash, a crypto mixing service. Its monitoring system also alerted a customer when exposure to stolen funds crossed a preset threshold.
The firm said compliance teams need transaction histories, tools to identify entities behind transfers and continuous monitoring to detect suspicious activity. These measures can help institutions investigate potential illicit flows and demonstrate compliance during regulatory reviews.
Related: UAE-Led Global Operation Flags $39B in Suspected Fraud-Linked Assets
Disclaimer: The information presented in this article is for informational and educational purposes only. The article does not constitute financial advice or advice of any kind. Coin Edition is not responsible for any losses incurred as a result of the utilization of content, products, or services mentioned. Readers are advised to exercise caution before taking any action related to the company.
