Aave Freezes 292 Reserves After Binance Hot Wallet Drain

Aave was not hacked. The money came from Binance hot wallets on Ethereum, and Aave froze lending markets across its networks because the exploiter had started using the protocol. At 20:24 UTC on 29 October 2026, a Binance hot wallet sent about 63 tokens and 167,464 ETH to a single address in one transaction, according to the incident report on Aave's governance forum.

If you hold a position on Aave, the freeze does not lock your funds. You can still repay and withdraw, and liquidations keep running. What you could not do while it lasted was open a new supply or borrow position, and that rule applied to everyone, the exploiter included.

The Drain Started at Binance and Kept Going

The first transfer was not the last. The exploiter received a further 28,006 ETH from a second Binance hot wallet, plus funds on Arbitrum, Optimism and Avalanche. An inflow of 444,537 AVAX at 23:04 UTC "suggests the compromise was still active more than two hours later," the report says.

The funds have since been spread across more than 20 new wallets. The exploiter is selling tokens such as UNI, LINK and AAVE for ETH on decentralised exchanges.

How the wallets were compromised and the total amount lost have not been confirmed by Binance. The Aave report describes the drain only as it appears on-chain.

One Loan, Taken 40 Minutes Before the Freeze

Between 20:58 and 21:01 UTC, one wallet in the exploiter's cluster supplied 60,000,000 USDT on Aave V3 Ethereum Core and borrowed 19,762 WETH, worth about $44.6 million at the time. That was about 40 minutes before the first freeze at 21:42 UTC, and it is the exploiter's only Aave position.

LlamaRisk, one of Aave's risk managers, says the position holds $59.9 million of USDT collateral against $43.8 million of debt. In the report's words, it "is over-collateralised and remains subject to normal liquidation. It does not put Aave suppliers at risk."

A forum user has posted that Tether blacklisted the exploiter's wallet, but that the USDT collateral sits in Aave's aUSDT reserve and so stays outside the blacklist. Neither Tether nor Aave has confirmed this.

What a Freeze Can and Cannot Do

LlamaRisk, Aave Labs, TokenLogic and Certora formed a war room and froze markets on every network. Their reason: the exploiter could swap stolen funds into any listed asset and use it on Aave.

A freeze is a narrow tool. It blocks new supply and borrow positions. It does not stop repayments, withdrawals or liquidations, and it does not seize or move anyone's money. Guardian multisigs, small groups of key holders with limited emergency powers, carried it out between 21:42 and 23:04 UTC:

• 175 reserves frozen on Aave V3 across 16 networks
• 117 reserves frozen on Aave V4 across four networks
• the Horizon RWA market left open, because all of its collateral is permissioned and cannot be used by the exploiter
• no market paused

The team explained why it picked a freeze over cutting supply and borrow caps: "the guardian can reverse it, while cutting caps instead would have needed a governance vote and about five days to restore." In other words, the freeze was the fastest switch available that could also be undone quickly.

What Changed for Lenders and Borrowers

The freeze had side effects. Suppliers pulled stablecoins out, pushing those reserves to between 92% and 100% utilization, meaning almost all deposited coins were lent out. Risk Stewards cut a rate parameter called Slope2 so the maximum borrow rate does not exceed 10% APR.

Borrow and draw caps were also cut to about 2% above pre-exploit borrowing. That removes about $3.7 billion of unused borrow capacity on Aave V3 and $130 million on Aave V4.

Markets reopen in four waves. Even after that, USDT, USDC, USDT0, POL, WAVAX, sAVAX, XAUt, PAXG and OP, including bridged and wrapped versions, stay at zero loan-to-value on V3 and a collateral factor of zero on V4 on every market. These are the assets held across the exploiter's wallets, so they cannot be used as collateral to borrow.

AAVE Fell More Than ETH

As of 00:55 UTC on 30 October, ETH and BTC were down about 4% since the drain, according to the report. Tokens the exploiter holds fell further: AAVE and LINK about 9%, UNI about 8% and ARB about 6%. Price oracles worked normally.

Aave's GHO stablecoin slipped from about $0.998 to $0.997 as holders redeemed about 4.6 million GHO for USDT through the GHO Stability Module.

Reopening Is Not Finished Everywhere

An update on 30 October said only the second of the four unfreeze waves had been executed. A forum post on 31 October says USDT is open again. Whether all four waves are done is not confirmed, so borrowers should expect some markets to still block new positions.

The open question is the exploiter's WETH loan. It stays healthy only while its USDT collateral covers the debt, and it can be liquidated like any other position if that changes.