Aave freezes V3 and V4 markets after suspected Binance exploiter deposits $60M USDT and borrows 19,762 WETH.
Security & Exploits ·
Aave's risk provider LlamaRisk, working with Aave Labs and the Aave Guardians, froze approximately 292 reserves across 16 or more networks on 29 October 2026 following a Binance hot wallet breach. The freeze encompassed 175 reserves on Aave V3 across 16 networks and 117 reserves on Aave V4 across four spoke chains. The action was triggered after an exploiter deposited $60 million USDT and borrowed 19,762 WETH on Aave V3 Ethereum Core between 20:58 and 21:01 UTC, about 40 minutes before the initial freeze took effect.
The freeze mechanism prevents new supply or borrow positions but allows users to repay debts and withdraw funds, while liquidations continue normally. LlamaRisk chose freezing over reducing supply caps because the guardian multisig can reverse a freeze, whereas restoring caps would require a governance vote and approximately five days. The exploiter's sole position on Aave held $59.9 million USDT collateral against $43.8 million debt, leaving it over-collateralized and posing no direct risk to Aave suppliers.
The response reflected broader systemic contagion concerns: the exploiter had already spread stolen funds across more than 20 new wallets and was converting tokens including UNI, LINK, and AAVE into ETH on decentralized exchanges. Real-time monitoring across multiple networks remained active, though no further Aave interactions by the exploiter occurred after the initial deposit. Phased unfreezing was planned once attacker fund flows ceased.