Aave freezes markets after Binance-linked wallet borrows $44.6M

Aave froze all DAO-operated V3 and V4 markets on Oct. 29 after a wallet linked to the Binance exploit deposited $60 million in USDT and borrowed 19,762 WETH, worth about $44.6 million at the time.

The restrictions covered 175 reserves on Aave V3 across 16 networks and 117 reserves on Aave V4 across four networks. Aave’s guardian multisigs imposed them between 21:42 and 23:04 UTC, according to a governance forum post from the protocol’s risk stewards.

The wallet supplied the USDT to Aave V3’s Ethereum Core market between 20:58 and 21:01 UTC, about 40 minutes before the first freeze. The position held about $59.9 million in collateral against $43.8 million in debt. It remained overcollateralized and subject to normal liquidation procedures, and the stewards determined that it did not put suppliers at risk.

Aave’s smart contracts were not exploited. The freeze prevents the wallet and other addresses linked to the attack from opening new positions. Users can still repay loans, withdraw funds and participate in liquidations.

Within 10 minutes of the first reports, LlamaRisk joined Aave Labs, TokenLogic and Certora in a response group. The group chose a full freeze instead of reducing supply caps because guardians could reverse the freeze immediately. A cap change would have required a governance vote and about five days to restore.

The freeze covered all DAO-operated markets because the attacker could exchange stolen assets for tokens listed on Aave. The Horizon real-world asset market was excluded because its collateral is permissioned and unavailable to the exploiter.

Risk stewards also reduced borrowing capacity during the freeze. Supplier withdrawals pushed utilization for major stablecoin and WETH reserves to between 92% and 100%. The stewards lowered interest-rate parameters and reduced borrow and draw caps to about 2% above pre-attack borrowing levels. The changes removed about $3.7 billion in unused capacity on V3 and $130 million on V4.

Aave’s GHO stablecoin fell from about $0.998 to $0.997 after holders redeemed about 4.6 million GHO for USDT through the stability module between 21:49 and 22:07 UTC on Oct. 29. GHO remained near $0.997, while major stablecoins held their pegs.

The wallet was part of a broader cluster linked to the Binance attack. At 20:24 UTC on Oct. 29, a Binance hot wallet on Ethereum sent about 63 tokens and 167,464 ETH to one address. Another hot wallet later transferred 28,006 ETH, while 444,537 AVAX reached the Avalanche network at 23:04 UTC. The attacker spread assets across more than 20 wallets and sold tokens including UNI, LINK and AAVE for ETH on decentralized exchanges.

Aave plans to restore markets in four waves. V3 reserves will initially be unfrozen with loan-to-value ratios set at zero, followed by restoration for most assets. On V4, selected reserves will receive a collateral factor of zero before trading resumes.

USDT, USDC, USDT0, POL, WAVAX, sAVAX, XAUt, PAXG and OP, including bridged and wrapped versions, will retain a zero loan-to-value ratio on V3 and a zero collateral factor on V4 wherever they are listed. Users will still be able to supply, withdraw, borrow and repay those assets, while existing positions will retain their liquidation thresholds. A zero loan-to-value ratio prevents collateral from creating new borrowing capacity.

The freeze will remain in place until the stolen funds stop moving and Binance provides more clarity on its containment efforts. The stewards have not set a date for completing the unfreeze.