Aave guardians froze 292 reserves across its V3 and V4 lending markets after a wallet linked to the Binance hot-wallet incident supplied 60 million USDT as collateral and borrowed 19,762 WETH. The freezes, executed between 21:42 and 23:04 UTC on October 29, block new supply and borrowing while leaving withdrawals, repayments and liquidations intact.

The position, opened on Aave V3 Ethereum Core between 20:58 and 21:01 UTC, carried roughly $59.9 million in USDT collateral against about $43.8 million in debt at the time of reporting. LlamaRisk described the loan as overcollateralized and subject to standard liquidation rules, with no further Aave activity from the cluster after the borrowing transaction.

Timeline of the Aave Position and Freezes

Earlier on October 29, a Binance hot wallet transferred approximately 167,464 ETH and dozens of other tokens to a single address around 20:24 UTC. Additional ETH and tokens, including large AVAX amounts, moved shortly afterward. Funds were distributed across more than 20 new wallets, with some tokens sold for ETH.

One address in that cluster then interacted with Aave, depositing the USDT and taking the WETH loan minutes before the freezes began. The action covered 175 V3 reserves on 16 networks and 117 V4 reserves on four networks. Networks affected included Ethereum Core and Prime, Arbitrum, Avalanche, Base, BNB Chain, Optimism and Polygon for V3, plus Ethereum, Avalanche, Base and Arc for V4.

The Horizon real-world asset market remained open because its collateral is permissioned. Guardians chose a broad freeze rather than limiting restrictions to the initially stolen assets, citing the risk that the funds could be swapped into any listed reserve.

Emilio stated on social media that the freezes aimed to prevent attackers from depositing stolen assets into Aave, which could hinder recovery efforts by asset issuers. He noted that setting borrow caps to zero alone would not close the deposit route.

Binance Incident Details and Response

Binance estimated the overall impact of the hot-wallet breach at about $6.3 billion, with roughly $3 billion frozen on-chain. The exchange said preliminary findings pointed to a compromised DevOps engineer’s laptop and unauthorized withdrawals, with no evidence that private keys had leaked. It temporarily suspended deposits and withdrawals and stated it would cover losses using its SAFU fund and company resources.

Separately, Arbitrum transferred 8,425 ETH and approximately 74.56 million ARB to a frozen address on Arbitrum One. The network said the action affected no other users or applications.

Market Conditions and Protocol Status

In the hours after the drain, ETH and BTC traded about 4 percent lower, while AAVE and LINK fell around 9 percent and UNI about 8 percent. Chainlink oracle feeds continued operating normally, and existing positions backed by those assets remained healthy according to risk assessments.

GHO saw modest redemptions of roughly 4.6 million tokens for USDT through the Stability Module, moving its price slightly lower. Aave markets are expected to stay frozen until the related funds stop circulating and further clarity emerges on containment, after which a staged unfreeze is planned in coordination with service providers.

The episode also prompted discussion of lending market design. Morpho’s Paul Frambot pointed to isolated markets as a way to limit contagion, noting that users can select exposure and that optional permissioning offers additional controls. He added that no design removes risk entirely.

Marc Zeller countered that Morpho Blue lacks certain emergency tools available on Aave, including the ability to freeze markets, adjust interest-rate curves or apply rate limits, and does not feature an Umbrella junior tranche for depositor protection.

LlamaRisk confirmed the Aave position remains the only one associated with the cluster across networks and versions, and that the loan continues under normal protocol rules without immediate risk to suppliers.