Aave froze every DAO-operated market across its V3 and V4 deployments on October 29, after a wallet in the Binance exploiter’s cluster deposited $60 million in USDT and borrowed 19,762 WETH — roughly $44.6 million at the time — over a three-minute window. The freeze, ordered through the protocol’s guardian multisigs between 21:42 and 23:04 UTC, covered 175 reserves on Aave V3 across 16 networks and 117 reserves on Aave V4 across four networks, according to the response posted by the protocol’s risk stewards on the Aave governance forum.
The move is the most direct spillover yet of the $6.3 billion Binance hot-wallet exploit into decentralized finance, and it restates a structural question that has trailed one of the largest lending protocols in the space for months: when a centralized venue is breached, can its protocols be used as an exit ramp before the funds are contained?
The exploiter’s position on Aave remains over-collateralized and does not put suppliers at risk, the stewards said. Aave’s own smart contracts were not exploited — the freeze is a containment measure aimed at a single borrower, not a response to a vulnerability in the code. Markets will stay frozen until the stolen funds stop moving and Binance’s containment effort is clearer, after which Aave Labs and the service providers will unfreeze them in four staged waves.
The DeFi Leg of the Binance Exploit
At 20:24 UTC on October 29, a Binance hot wallet on Ethereum sent roughly 63 tokens and 167,464 ETH to a single address in one transaction. A second hot wallet moved another 28,006 ETH minutes later, and a further 444,537 AVAX arrived on Avalanche at 23:04 UTC — evidence, the stewards wrote, that the compromise was still active more than two hours after the first outflow.
The attacker has since spread the funds across more than 20 new wallets and has been selling governance tokens such as UNI, LINK and AAVE for ETH on decentralized exchanges. Between 20:58 and 21:01 UTC, one wallet in the cluster supplied $60 million of USDT on Aave V3 Ethereum Core and borrowed 19,762 WETH, about 40 minutes before the first freeze at 21:42.
“The position holds $59.9M of USDT collateral against $43.8M of debt, so it is over-collateralised and remains subject to normal liquidation. It does not put Aave suppliers at risk,” the stewards wrote. That implies a collateralization ratio of roughly 1.37 times and an effective price of about $2,257 per WETH on the borrow, well above the liquidation threshold.
Why a Freeze, Not a Cap Cut
Within 10 minutes of the first reports, LlamaRisk joined Aave Labs, TokenLogic and Certora in a joint war room. The group decided against cutting supply caps in favor of a full freeze, because a freeze could be reversed by the guardians immediately, while a cap change would have required a governance vote and about five days to restore.
“We chose a freeze because the guardian can reverse it, while cutting caps instead would have needed a governance vote and about five days to restore,” the post states. “A freeze stops anyone, including the exploiter, from opening new supply or borrow positions. Users can still repay and withdraw, and liquidations keep running.”
The freeze’s breadth reflects how the protocol’s risk model works: because the exploiter could swap stolen funds into any listed asset, freezing only the reserves holding the stolen tokens would have left other entry points open. The Horizon RWA market was left untouched because its collateral is permissioned and cannot be used by the exploiter.
Risk Stewards Strip $3.8 Billion of Borrowing Capacity
While markets were frozen, the risk stewards executed two batches of changes. The first lowered Slope2 on the largest stablecoin reserves and WETH so the borrow rate at full utilization stays below 10.00% APR; supplier withdrawals had pushed those reserves to between 92% and 100% utilization. The second batch, detailed in a separate governance post, reduced borrow and draw caps on the largest borrow paths to about 2% above the amount borrowed just before the exploit, removing roughly $3.7 billion of unused borrow capacity on V3 and $130 million on V4.
GHO, Aave’s stablecoin, slipped from about $0.998 before the drain to $0.997 after holders redeemed roughly 4.6 million GHO for USDT through the stability module between 21:49 and 22:07 UTC, and it has held near that level since.
A Four-Wave Unfreeze With the Exploiter’s Assets Locked
The unfreeze will run in four waves. V3 reserves are unfrozen first with loan-to-value kept at zero, then LTV is restored for the majority. On V4, a keep-list of reserves receives a new collateral configuration with a collateral factor of zero before the unfreeze. USDT, USDC, USDT0, POL, WAVAX, sAVAX, XAUt, PAXG and OP — including bridged and wrapped versions — stay at LTV 0 on V3 and collateral factor 0 on V4 on every market where they are listed, because those are the assets held across the exploiter’s address cluster.
LTV 0 only stops those assets from adding new borrowing power when used as collateral. Supplying, withdrawing, borrowing and repaying them continues to work, and existing positions keep their liquidation thresholds.
The Systemic-Risk Question
By 00:55 UTC on October 30, ETH and BTC were down about 4% since the drain, while governance tokens the exploiter holds had fallen further: AAVE and LINK about 9%, UNI about 8% and ARB about 6%, according to the stewards. Stablecoins held their pegs. The freeze prevents the exploiter from depositing any of those tokens on Aave.
The stakes extend beyond a single loan. Aave’s markets pool liquidity across Ethereum and more than a dozen other networks, and a meaningful portion of that liquidity is stablecoins issued by Tether and Circle — the same issuers that moved to freeze stablecoins tied to the Binance attack. Forum participants pointed to the possibility that the exploiter could have routed a far larger share of the roughly $6.3 billion in stolen assets through Aave’s pools, and questioned whether a lending protocol of that scale can rely on centralized issuers and courts to contain a breach it did not cause.
The episode echoes the Kelp DAO incident, when a governance council froze $71 million in ETH tied to an earlier attacker. But it also reopened a live governance debate: several community members argued that without a protocol-level flow limit, Aave risks becoming an exit ramp for stolen funds whenever an outside venue is breached. Others called the freeze an overreaction to a $60 million deposit that was never a solvency threat.
The stewards have not committed to a timeline. The unfreeze is tied to the exploiter’s funds going dormant and to clearer containment on Binance’s side. Watch the four-wave LTV restoration, the utilization on frozen reserves as large suppliers withdraw, and whether the flow-limit proposals gain traction in governance — each will determine how quickly the largest lending market in DeFi returns to normal and whether this breach changes its risk model for good.
