Aave restored normal operations across its V3 and V4 lending markets on October 30, 2026, roughly 16 hours after suspending new deposits and borrowing. The move followed reports of a major security breach at Binance that resulted in losses estimated at $6.3 billion. Aave stated that its smart contracts remained unaffected and that all user positions stayed fully collateralized during the restriction period.

The freeze began at approximately 21:42 UTC on October 29 after early alerts about compromised Binance-affiliated wallets. Withdrawals, repayments, and liquidations continued without interruption, allowing users to access funds and manage existing debt. In total, 175 reserves were frozen on V3 across 16 networks and 117 on V4 across four networks. The Horizon market for tokenized real-world assets remained open because its collateral is permissioned and inaccessible to the attacker.

Attacker Activity on Aave

On-chain records show that a wallet linked to the incident deposited 60 million USDT into Aave V3 on Ethereum Core between 20:58 and 21:01 UTC and borrowed approximately 19,762 WETH, valued at about $44.6 million. This occurred roughly 40 minutes before the freeze took effect. The resulting position held $59.9 million in collateral against $43.8 million in debt, leaving it overcollateralized at roughly 73 percent and subject to standard liquidation rules. No further activity from the associated addresses has been recorded on the protocol since that time.

Risk analysts confirmed that price feeds functioned normally and major stablecoins maintained their pegs, though Aave’s own GHO stablecoin briefly slipped from $0.998 to $0.997 as holders redeemed nearly $4.6 million.

Nine Assets Remain Restricted

While most markets have returned to full functionality, nine assets continue under temporary restrictions: USDT, USDC, USDT0, POL, WAVAX, sAVAX, XAUT, PAXG, and OP, including their wrapped and bridged versions. These tokens now carry a zero loan-to-value ratio on V3 and a zero collateral factor on V4. Users may still deposit, borrow, withdraw, and repay them, but the assets cannot serve as collateral for new loans. Existing positions on V3 retain their original liquidation thresholds, so health factors remain unchanged. On V4, collateral parameters stay as they are unless a borrower modifies or withdraws them.

The reopening proceeded in four stages managed by protocol guardians. Risk stewards first restored all frozen V3 reserves with borrowing power held at zero, then applied zero-collateral settings to the keep-list assets on V4. Borrowing power was subsequently restored for most V3 reserves, followed by the full unfreeze of V4 markets while the nine assets stayed restricted.

Protective Measures and Capacity Adjustments

During the freeze, utilization rates on several major stablecoin pools climbed as high as 100 percent because new deposits were blocked while withdrawals continued. To limit interest-rate spikes, risk stewards temporarily reduced Slope2 parameters, capping borrow rates at full utilization at 10 percent APR. Borrowing caps were also tightened to levels only slightly above pre-incident figures, removing roughly $3.7 billion of unused capacity on V3 and $130 million on V4. These steps aimed to prevent sudden liquidity shocks once markets reopened.

Binance Incident Details

Binance reported that its hot wallets were compromised around 20:05 UTC on October 29, producing losses of approximately $6.3 billion. Blockchain analytics firm Elliptic placed the figure at $6.43 billion, more than four times the size of the Bybit incident in 2025. The exchange has allocated more than $6.34 billion from its Secure Asset Fund for Users and corporate resources to cover the shortfall and stated that nearly $3 billion in assets has been frozen on-chain. Withdrawals remain suspended while deposits continue, with a phased restart targeted within roughly 34 hours of the update and a proof-of-reserves result expected by November 2.

The episode illustrated how quickly activity on a centralized exchange can affect decentralized lending pools. Aave’s rapid response, including the formation of a joint war room within ten minutes of the first reports, limited exposure while preserving user access to existing positions. Markets now operate under the continuing zero-LTV controls on the nine listed assets as a precautionary measure.