Aave’s precautionary market freezes following the Binance hot-wallet exploit have drawn scrutiny after on-chain activity showed a wallet linked to the attacker deposited approximately 60 million USDT as collateral on Aave V3 Ethereum Core and borrowed about 19,762 WETH (valued at roughly $44.6 million at the time). The transactions occurred between 20:58 and 21:01 UTC on October 29, 2026—approximately 40 minutes before Aave’s first freeze action at 21:42 UTC.
According to Aave’s risk response (via LlamaRisk and governance updates), the position holds about $59.9 million in USDT collateral against roughly $43.8 million in debt, remaining over-collateralized and subject to normal liquidation mechanics. Aave stated that the position does not put suppliers at risk and that no further interactions from the linked wallet cluster have occurred on the protocol. The freezes blocked new supplies and borrows across 175 V3 reserves on 16 networks and 117 V4 reserves on four networks, while allowing repayments, permitted withdrawals, and liquidations to continue.
Aave emphasized that its contracts were unaffected and that the freezes were a precautionary measure to limit potential further use of stolen assets across listed markets. Social media commentary has focused on the timing of the loan relative to subsequent stablecoin freezes by issuers and the conversion of freezable USDT into unfreezable ETH.
The Drivers of the Current Situation
The main development is Aave’s rapid multi-network market freezes in response to the Binance incident, combined with the confirmed over-collateralized loan taken by a wallet associated with the attacker shortly beforehand. Confirmed elements include the 60 million USDT deposit and 19,762 WETH borrow on Aave V3 Ethereum Core, the position’s current over-collateralized status, Aave’s statement that suppliers face no risk from it, the scope of the freezes across V3 and V4 markets, and the decision to pause new activity while preserving existing position management. These steps followed coordination among Aave Labs, risk providers, and other parties.
Any liquidation of the position, unfreezing of markets, or further on-chain activity will provide the next clarity.
Impact and Broader Context
The episode has highlighted how decentralized lending protocols can be used to convert freezable assets into native tokens that lack issuer-level freeze capabilities, as well as the operational trade-offs of emergency freezes that affect ordinary users. It raises questions about the effectiveness and timing of market freezes, the handling of over-collateralized positions left by attackers, the potential for similar conversion strategies in future incidents, the balance between protocol safety and user access, and the broader interplay between centralized exchange breaches and DeFi infrastructure. Coverage distinguishes between Aave’s unaffected contracts and the precautionary response to external stolen funds.
Subsequent market reopenings, liquidation outcomes, or updates from Aave risk teams will determine the lasting effect.
This analysis draws from Aave governance and risk updates, LlamaRisk commentary, and contemporaneous on-chain reporting. The final status of the loan, any related recoveries, and the duration of residual restrictions remain subject to further protocol actions and market conditions.