Aave lending protocol freeze illustrated with a green padlock, Ethereum coins, and Binance-related security imagery in olive green, light green, and black.

Aave Freezes Markets After Binance-Linked Wallet Borrows 19,762 WETH

By /

Key Insights

  • Aave blocked withdrawals and repayments but did not block new deposits and loans.
  • The identified wallet borrowed 19,762 WETH, which corresponds to about USDT worth of $60 million.
  • The situation illustrates that DeFi lending pools can play a key role in redeeming assets in case of exchange security breaches.

Aave froze deposits and borrowing on its DAO-operated V3 and V4 markets on October 29 2026. This happened after wallets connected to a suspected Binance security breach were seen using the lending protocol to convert USDT into WETH. The move was precautionary. It limited exposure across hundreds of reserves. Withdrawals, repayments and existing liquidation mechanisms were still allowed to function.

Aave restricts markets after large WETH borrow

Aave risk service provider LlamaRisk reported that a wallet linked to the Binance incident deposited approximately $60 million in USDT into Aave V3 Ethereum Core between 20:58 and 21:01 UTC. The wallet borrowed 19,762 WETH, worth approximately $44.6 million, against the collateral.

The transactions occurred roughly 40 minutes before Aave initiated its first freeze. According to Aave’s governance forum update, the wallet represented the only identified position linked to the activity across Aave’s markets and versions.

The position remained overcollateralized, with approximately $59.9 million in USDT backing roughly $44 million in WETH debt. The transaction, however, brought concerns, as the borrower was swapping a stablecoin issued by the same entities that are able to freeze, which is not the case with ether.

Aave also stated that its smart contracts were not impacted. Existing positions were to be subject to the usual liquidation procedures and the users could keep withdrawing assets and paying back loans.

Freeze covers hundreds of reserves across networks

Aave’s risk contributors coordinated the response with Aave Labs, TokenLogic, and Certora. They selected a broad freeze because the suspected attacker could potentially use available lending markets to convert assets into other supported tokens.

The freeze covered 175 V3 reserves across 16 networks and 117 V4 reserves across four networks. Horizon real-world asset markets remained open because their permissioned collateral arrangements presented different exposure considerations.

The intervention also allowed Aave’s guardian to reverse the restrictions without waiting for a multiday governance process. Consequently, the protocol could limit new borrowing quickly while retaining a route toward reopening markets once the immediate risks diminished.

Key details from the incident include the following:

  • Collateral deposited—Around $60 million in USDT.
  • WETH borrowed—19,762 WETH, valued at roughly $44.6 million.
  • V3 restrictions—175 reserves across 16 networks.
  • V4 restrictions—117 reserves across four networks.
  • User access—Withdrawals and repayments remained available.

In October 30, Aave also kept on monitoring the utilization of reserves and withdrawal activity. Repayments may help to relieve pressure on borrowings, and affect the reopening order, whereas large withdrawals may lead to higher borrowing rates.

Binance investigation raises broader security concerns

The Aave liquidations were triggered by large withdrawals from the Binance-marked hot wallets, which started around 20:24 UTC on October 29. It’s possible that a service container was compromised using a laptop belonging to a DevOps engineer who was part of Binance’s preliminary investigation, the company said.

The exchange has estimated the impact to be around $6.3 billion and is already working with blockchain partners to freeze the affected assets. Binance also vowed to compensate losses from the Secure Asset Fund for Users and Binance’s own funds.

Meanwhile, Tether chief executive Paolo Ardoino confirmed that the company had frozen more than 1.567 billion USDT associated with the potential incident. Circle and other issuers also took action against assets linked to the activity.

These interventions show a difference between stablecoins and ether. Issuers can block addresses that hold stablecoins. Decentralized lending pools can give users access, to other assets before the restrictions take effect.

Aave therefore faced a containment challenge rather than evidence of a direct protocol exploit. Its response sought to prevent additional conversion activity without blocking users from managing existing positions.

Limited exposure keeps attention on market stability

Aave contributor Marc Zeller said the protocol would remain stable despite the incident. He cited the position’s overcollateralization and argued that ordinary liquidation mechanisms could manage the debt if its collateral value deteriorated.

The loan amount was about 0.9% of the total amount of WETH in the Aave V3 core reserve, Zeller added. If prices of ether were to exceed, say, $2,365, then he said liquidation might be required, assuming that were the ether price at the time of his assessment.

The episode, however, is reminiscent of Aave’s April 2026 reaction to the Kelp DAO bridge exploit. In that case, it was an unbacked rsETH collateral and high WETH borrowing which generated bad debt and needed coordinated recovery.

The current case differs because the identified position remains overcollateralized. However, it demonstrates how permissionless lending protocols can facilitate asset conversion during exchange security incidents, even when their own contracts remain secure.

Conclusion

The market freeze that Aave went through allowed for only existing users to have access to essential features and functions while blocking new exposure. Once the protocol had reopened markets, it continued to monitor the linked wallets, price feeds and reserve conditions.

The incident highlights the need for quick coordination among exchanges, stablecoin issuers, and decentralized finance (DeFi) platforms. Aave will take action depending on the flow of impacted funds, the investigation process of Binance, and the assessment of the remaining risks by the project.

Related Posts

Scroll to Top