A USDC whale pulls $290M out of Aave and Sky every night. It sits in one wallet across midnight, then goes straight back
A chart of Aave's USDC market kept spiking at the same time each night. We followed the spike to one cluster of wallets and more than two years of round trips.
- $290M
- 394
- 37x
- 99.6%
- 13.8%
- $16.4M–17.4M
01 · The spikeA spike on Aave's chart at midnight, every night
If you keep USDC on Coinbase, Coinbase pays you a reward for holding it. The more you hold, the more you earn. So the moment your balance gets counted matters a lot.
On 27 October, the developer wavey, who builds Ethereum data tools, posted a chart of Aave's USDC market on X. Aave is the largest lending app on Ethereum. People deposit USDC there to earn interest, and others borrow it. The chart showed the share of those deposits that was lent out, and it jumped around midnight UTC, night after night. Following the money, wavey found one wallet behind the jumps and wrote that it looked like a whale gaming Coinbase and Circle's USDC rewards.
We checked that against every USDC transfer the whale's wallets have made since July 2024, using Bitquery's Ethereum data. The pattern is real. Every night in October, a cluster of wallets, a group that moves money as one owner, took about $290M out of Aave and out of Sky, the stablecoin project that used to be MakerDAO. It parked that USDC in one wallet across 00:00 UTC and put it back about half an hour later.
That timing fits a reward that counts balances once a day, at midnight. Coinbase does not publish when it counts, so the motive is our reading of the record. The other numbers in wavey's thread held up, apart from one estimate of the whale's income that we could not rebuild.
02 · USDC rewardsCoinbase USDC rewards: what is public and what is not
Circle issues USDC, the second-largest dollar stablecoin. Coinbase pays USDC rewards to people and firms that hold it on Coinbase. Coinbase Prime, its service for institutions, lists simple rewards of up to 3.40% per year. Its documentation says the rewards build up daily and are paid out once a month.
What Coinbase does not publish is how it counts the balance each day. It could take one reading, an average of many readings, or something else. If it takes one reading at midnight, the balance at that second is all that counts.
Coinbase also runs a USDC rewards program with Sky. Sky's PSM is a swap desk that turns Sky's USDS stablecoin into USDC one for one. The USDC behind it sits in a wallet that Sky set up with Coinbase Custody, Cointelegraph reported in 2024. Sky also has a savings token, sUSDS, which is USDS that earns interest while you hold it.
03 · The round tripOne night, step by step
Take the night of 26 to 27 October. Two of the whale's wallets did the pulling. We call one of them the Aave wallet, because it holds the cluster's Aave deposit. The other is the Sky wallet, which holds its sUSDS.
Just after half past eleven UTC, the Aave wallet withdrew USDC from Aave. A minute later the Sky wallet cashed in sUSDS and swapped it for USDC through Sky's PSM. Both sent the money to a third wallet, the hub. A few minutes later the hub passed all of it to a fourth wallet.
That fourth wallet, the midnight wallet, is the one wavey found. It held $241.6M across midnight and sent every cent back to the hub a few minutes after. The hub returned the money to the Aave and Sky wallets, and within a quarter of an hour it was earning in Aave and sUSDS again.
Each wallet signs its own transactions. None of them is a smart contract, and you can follow all four with our address APIs. The whole trip takes about ten transfers per night.
04 · Every nightEvery midnight for 394 nights
The round trip runs on a clock. We matched 678 nights, and on nine in ten of them the money reached the midnight wallet in the last half hour before midnight UTC and left within half an hour after. The median stay is 24 minutes. On none of those nights did it leave before midnight.
The first night through that wallet was in July 2024. The cluster has not missed a midnight since the end of September 2025, and it ran again the night after our data ends.
05 · Two yearsAt midnight it holds 37 times its daily average
Outside the half hour around midnight, the cluster holds almost no plain USDC. Its money sits in Aave and sUSDS, earning interest. At midnight that flips.
On a median night the cluster's USDC balance at midnight is 37 times its daily average. A reward paid on a single midnight reading would see the big number.
The nightly sum grew in steps and more than tripled between the middle of 2025 and the middle of 2026. The biggest night, at the start of November 2025, held $519.5M.
06 · The sourcesFirst Aave, then Sky, now both
Until early 2025, the money came only from Aave. Then the cluster added its sUSDS, and Sky's PSM soon carried most of the load. Aave became a nightly source again at the start of 2026.
In October the Sky part averaged $154M per night, the same figure wavey posted. Aave supplied the rest.
07 · AaveAave USDC utilization hits 99.6% for half an hour
A lending app needs some spare cash. At Aave that touches a lot of people, because Aave holds more than half of all DeFi lending on Ethereum. Utilization, the share of deposits lent out, tells you how much is left for lenders who want to withdraw. Past a set level, Aave raises the borrowing rate sharply to pull cash back in.
Just before the whale's withdrawal on 26 October, the Aave v3 USDC pool had $173.0M of spare USDC. The whale took 78% of it in one go. Utilization jumped, and the rate Aave charges borrowers more than doubled.
Utilization and the borrow rate stayed up until the money came back. In that window, every other lender on the pool shared less than $46M of withdrawable USDC. And that was a mild night.
On the median October night, the withdrawal pushed utilization to 99.6%. On the worst night the pool was left with $12k of spare USDC. This is the spike in wavey's chart.
08 · The payoffWhat it could earn, and who pays
We cannot see what Coinbase pays the whale. We can work out what a reward on the midnight balance would come to. Coinbase lists up to 3.40% for Prime and up to 3.60% for its developer wallets. At those rates, the cluster's midnight balances since mid-2024 would have earned between $16.4M and $17.4M.
The whale's cost is small. It pays gas on about ten transfers per night and gives up about half an hour of interest, roughly $980 at 5% per year.
Who pays depends on where the money came from. If Sky's PSM USDC earns rewards on the same midnight reading, the $154M pulled from it each night moves that reward from Sky to the whale. In the thread, wavey put Sky's cost at about $395k for October so far, and the arithmetic holds at 3.6%. The money from Aave is different. Aave's pool is a smart contract and is unlikely to be enrolled, so a reward on that part would be new money paid out by Coinbase.
09 · The first reportChecking wavey's numbers
The find first appeared in a short thread by wavey. We checked each claim against the record.
| wavey's claim | What the record shows | Verdict |
|---|---|---|
| Spikes around midnight, every night | A withdrawal of about $134M from Aave in the 23:00 UTC hour on all 26 October nights | Right |
| About $300M per night from Aave and Sky | $290M per night on average in October | Right |
| About $154M per night from Sky's PSM | $154M per night | Right |
| Back a few blocks later | Back in Aave and sUSDS a median 37 minutes later; the midnight wallet holds it 24 minutes, about 118 blocks | Longer |
| Round trips since July 2024 | First night 26 July 2024 | Right |
| About $395k of Sky rewards lost this month | $395k at 3.6%, if Sky's USDC is counted at midnight | Math holds |
| About $1.15M of wallet income this month | $736k to $780k at 3.4% to 3.6% for 1 to 27 October | Not rebuilt |
| Gaming Coinbase and Circle's rewards | The timing fits a midnight reading; the reward terms are not public | Likely |
10 · The whaleThe money trail points to a big Coinbase client
None of the address labels we hold names the owner, and we will not guess one. The money trail does describe the kind of client.
| Evidence | What the record shows |
|---|---|
| From Circle | $4.32B to the hub and $32.5M straight to the midnight wallet, from a wallet our labels mark as Circle's |
| From Coinbase | $845M to the hub and $10.0M straight to the midnight wallet from a Coinbase Prime hot wallet, plus $3.2M from a Coinbase exchange hot wallet |
| To exchanges | $1.65B to Bullish deposit addresses, $951M to Coinbase deposit addresses, $429M to Paxos and $58M to Binance, plus $822M to a hot wallet our labels mark as NonCo's |
| Other coins | The hub also moves PYUSD, USDG, USDT and cbBTC |
| Wallet type | Plain wallets that sign their own transactions, with no contract code |
That profile fits an institution with Coinbase Prime access and a Circle Mint account, the service that lets big clients turn dollars into new USDC. A trading desk or a stablecoin treasury would look like this. The main addresses are listed at the end.
11 · The look-alikesHundreds of fake wallets trail the whale
A whale that moves large sums at the same time every night is a target for address poisoning. Scammers create wallets whose addresses start and end like the real ones, then plant fake transfers in the whale's history. They hope someone copies the wrong address next time. Poisoners also logged thousands of zero-value USDC transfers from the whale's wallets to look-alike addresses, a common way to plant fake entries.
They go further than dust. Just after midnight on 27 October, a fake token named like USDC logged a transfer from the real Aave wallet to a copy of the hub's address. Its amount matched the real transfer from half an hour earlier, down to the last decimal. We found no case of real USDC going to a look-alike from any of the four wallets.
12 · What it meansWhat this means for Coinbase, Aave and Sky
A once-a-day reading is easy to time. As a fix, wavey suggested reading balances at random times or more often. An average over the day would also make this round trip pointless. Either change is Coinbase's call.
For Aave, the cost is a nightly window with almost no spare USDC. Anyone who needs to withdraw a large sum near midnight UTC may have to wait half an hour. Borrowers pay for that window too. On the median October night, the borrow rate went from 4.5% to 13.8%, about three times the usual level. Lenders who stay in earn more for it, 10.3% instead of 3.7% on 26 October.
For Sky, the question is whether its own rewards are counted the same way. If they are, a large depositor is redeeming sUSDS just before each count and buying it back just after. Stablecoin yield trades can turn fast when they get crowded, as the Ethena USDe loop on Aave did.
13 · How we checkedMethod and limits
We rebuilt each wallet's USDC balance from every transfer since July 2024 and read it at midnight UTC, day by day. We then checked nine of those midnights against a public Ethereum archive node, a server that can show any past balance, and the balances matched. The Aave pool figures come from the same node, block by block. Our address labels name the exchanges and stablecoin issuers in the trail, and our token holder data covers the USDC balances.
Anyone can follow these wallets with the Bitquery MCP, which lets you ask an AI assistant where a wallet's money goes. The full Ethereum history is also sold as files. Bitquery does this kind of tracing for clients through its crypto investigation services, and our Tether blacklist audit used the same data.
The data runs from 26 July 2024 to 00:13 UTC on 27 October 2026, plus one later night read on 28 October.
Reward figures are estimates at 3.4% and 3.6% per year on the balance at 00:00 UTC. We cannot see the terms this client gets, the rate it is paid, or which wallet, if any, earns it.
Balances count plain USDC from transfers of $1 or more. Leaving out smaller dust moves no midnight balance by more than $31 against an archive node.
Aave pool figures come from an archive node, read at the blocks before and after each transfer and about once a minute in between.
We name Coinbase, Circle, Sky, Aave, Paxos and Bullish only for the role their wallets or contracts play in these transfers. Nothing here suggests any of them did anything wrong.
The record shows which wallets moved money and when. It does not show who controls them.
14 · The addressesWhere to look
These are the wallets and transactions behind this story.
Watch the midnight round trip yourself
Every transfer in this story comes from Bitquery's Ethereum data. The Bitquery MCP server puts that data behind an AI assistant, so you can ask what a wallet did last night, or which labels an address carries, without writing a query. The full history is also sold as files on the Bitquery Data Store, as the Ethereum dataset.
This article is provided for informational and educational purposes only and reflects analysis of publicly available on-chain data as of the dates indicated. It does not constitute legal, financial, compliance, or investment advice, and nothing in it is a recommendation to buy, sell or hold any token or asset, or to use or avoid any protocol, exchange or service.
The findings describe transactions and balances observed on Ethereum between 26 July 2024 and 28 October 2026. Attributions come from Bitquery's address labels and from on-chain behaviour; they may be incomplete or incorrect and may be revised as more data becomes available.
References to Coinbase, Circle, Sky, Aave, Paxos, Bullish, Cointelegraph or any other named project, company, service or person describe what the public record shows about addresses and transactions linked to them, and what those parties have said in public. They are not statements about any party's intent, practices, solvency or conduct, and nothing here asserts that any named party, or the owner of the wallets described, acted unlawfully or broke any rule or agreement.
Nothing herein should be relied upon as a definitive determination of fact. Readers should conduct their own independent verification before taking any action. The authors and publisher accept no liability for any loss or damage arising from reliance on this material. All trademarks and company names are the property of their respective owners.
Reported by Gaurav Agarwal for Bitquery Research, with AI tools; every figure was checked against the raw data.
FAQ
Why does Aave's USDC utilization spike at midnight?
In October, one large depositor withdrew about $134M of USDC from Aave v3 just before 00:00 UTC each night and put it back a few minutes after. That took most of the pool's spare USDC for about half an hour. On the median night, the share of deposits lent out jumped from 94.0% to 99.6%.
How are Coinbase USDC rewards calculated?
Coinbase Prime lists simple USDC rewards of up to 3.40% per year, built up daily and paid monthly. Coinbase does not publish how it reads the daily balance. The whale's round trip fits a single reading near midnight UTC.
Who is the USDC whale?
We do not know. The wallets have received USDC from a Coinbase Prime hot wallet and from Circle, and have sent USDC to deposit addresses at Coinbase, Paxos and Bullish. That fits an institution, such as a trading desk, but no label names the owner.
How much could the whale earn from USDC rewards?
If Coinbase paid its listed rates on the midnight balance, the cluster would have earned between $16.4M and $17.4M since mid-2024. We cannot see the actual payments, which happen off-chain.
Does this hurt Aave lenders or sUSDS holders?
Aave lenders lose access to most spare USDC for about half an hour on the nights the whale draws on Aave, and borrowers pay a higher rate in that window. Sky loses rewards only if its own USDC is counted at the same midnight reading.
Is the whale still doing it?
Yes. It ran again on the night of 27 to 28 October, the latest night we checked.