Aave, a leading decentralized lending protocol, resumed operations on its V3 and V4 markets on October 30, 2026, after a major hacking incident at Binance led to the temporary suspension of its services. The attack had resulted in $6.3 billion in losses and prompted Aave to adopt precautionary measures, including closing lending markets for several assets.
Markets resume, with restrictions on nine assets
Aave confirmed that all major lending markets have returned to normal operations, with the exception of nine specific tokens that remain under restrictions. These assets include USDT, USDC, USDT0, POL, WAVAX, sAVAX, XAUT, PAXG, and OP, along with their wrapped and bridged forms. The protocol reported that existing smart contracts were unaffected and user positions remained secure throughout the freeze.
According to a statement from risk analytics platform LlamaRisk, these nine assets now carry a zero loan-to-value (LTV) ratio in Aave V3 and zero collateral factor in V4. This means users may still deposit, borrow, withdraw, and repay these assets as before, but they cannot be used as collateral for new loans. Existing positions in V3 are not affected, and on V4, collateral parameters will continue unchanged unless modified or withdrawn by the borrower.
For the nine restricted assets—such as USDT and USDC—users can still transact, but cannot use them as collateral for new borrowing, as confirmed by LlamaRisk.
Aave’s actions followed the discovery that a hacker had deposited $60 million in stolen USDT into Aave V3 on the Ethereum Core platform and borrowed approximately 19,762 WETH, valued at $44.6 million, shortly before markets were frozen.
Mini dictionary: LlamaRisk is a blockchain analytics platform focused on assessing and monitoring risk in DeFi lending protocols such as Aave and Compound.
Details of the Binance hack’s impact and risk controls
Aave reacted by freezing deposits and new borrowing at 21:42 UTC on October 29, though withdrawals, repayments, and liquidations remained possible. LlamaRisk indicated the hacker’s position held $59.9 million in assets against $43.8 million in debt, indicating the position was overcollateralized and posed no risk to other Aave users.
With the freeze in place, borrowing across Aave halted, limiting new deposits but allowing withdrawals by suppliers. Liquidity in major stablecoin pools fell, causing utilization rates to climb as high as 100%. Normally, elevated borrowing rates would attract deposits, but since reserves were frozen, borrowers faced increased interest costs. LlamaRisk addressed this by temporarily reducing Slope2 interest rate parameters.
The swift reduction of available borrowing capacity by $3.7 billion in V3 and $130 million in V4 helped prevent sudden liquidity stress as markets reopened, according to LlamaRisk.
Aave’s risk stewards tightened caps on borrowing and drawing limits to avoid abrupt shocks when markets resumed and implemented re-openings in four stages. Most assets are now fully functional for lending and collateral purposes, except for the nine with collateral restrictions.
| Version | Unused Borrowing Capacity Cut |
|---|---|
| V3 | $3.7 billion |
| V4 | $130 million |
Broader effects on crypto credit and trading
The incident underscores the interconnectedness of centralized exchanges and decentralized finance protocols. Although Binance suffered the breach, the attackers were able to use Aave’s decentralized liquidity to facilitate their activities, forcing Aave to take protective measures.
Elliptic, a blockchain investigation firm, placed the Binance hack’s losses at $6.43 billion—over four times greater than the $1.46 billion Bybit theft in 2025.
Binance, one of the largest cryptocurrency exchanges globally, pledged to cover the missing funds through its Secure Asset Fund for Users (SAFU) and corporate resources. The company stated that around $3 billion in assets had been frozen on-chain, though asset freezes do not guarantee recovery.
The hack’s repercussions were felt beyond lending, with trading firms like GSR observing Bitcoin price spreads widen to five times their typical size, while Ether spreads reached 2.5 times the norm. Aave’s return to operation marks a step toward normalcy in crypto lending, yet highlights how security breaches on one platform can disrupt liquidity and activity across the ecosystem.
