Aave Freezes 292 Reserves After Binance Breach; Recovery Plans Remain Conditional

Aave froze 292 lending reserves following the Oct. 29, 2026, breach of Binance wallets, after an attacker-linked address deposited stolen funds into the decentralized lending protocol and borrowed wrapped ether. The emergency restrictions blocked new deposits and borrowing while leaving repayments, withdrawals and liquidations available, according to Aave’s incident account.

The response covered 175 reserves on Aave V3 across 16 networks and 117 reserves on V4 across four networks. The incident originated at Binance rather than in a reported exploit of Aave itself, but the movement of stolen assets into lending markets prompted a broader containment effort. Bitcoin.com reported the freeze and Binance’s subsequent recovery commitments.

Transfers spread across chains before the freeze

Aave’s account places the first major Ethereum transfer at 20:24 UTC on Oct. 29, when 167,464 ETH and 63 other tokens left a Binance hot wallet. Another Binance wallet subsequently sent 28,006 ETH to the attacker, bringing those two ether transfers to 195,470 ETH. Assets also moved across Arbitrum, Optimism and Avalanche.

The ether transfers represented only part of the breach. Binance estimated approximately $6.3 billion in affected assets, while blockchain analytics company Elliptic estimated $6.43 billion. Those estimates describe the broader incident, not simply the value of the ether taken.

According to Aave, the attacker distributed funds among more than 20 addresses and sold tokens including UNI, LINK and AAVE for ether on decentralized exchanges. Its timeline records a further 444,537 AVAX arriving on Avalanche at 23:04 UTC, showing that asset movements continued well after the initial Ethereum transfer.

These UTC timestamps correct the Eastern-time conversions in the original report. The first transfer occurred at 4:24 p.m. Eastern daylight time; the cited Avalanche inflow occurred at 7:04 p.m. EDT.

Why Aave halted new activity

Between 20:58 and 21:01 UTC, an attacker-linked wallet supplied 60 million USDT to Aave V3’s Ethereum Core market and borrowed 19,762 wrapped ether, initially valued at approximately $44.6 million. Elliptic’s analysis also identified this borrowing strategy.

Aave reported a subsequent snapshot of approximately $59.9 million in USDT collateral against $43.8 million in debt. The response team assessed the position as overcollateralized and not presenting a direct insolvency risk to suppliers at that point. That was a time-specific assessment, not a guarantee against changes in collateral value, debt or market conditions.

Teams from Aave Labs, Tokenlogic, Certora and security partners coordinated the response. Guardian multisignature wallets executed the freezes between 21:42 and 23:04 UTC, covering major markets including Ethereum, Arbitrum, Avalanche, Base, Optimism, Polygon and BNB Chain. The permissioned Horizon real-world-asset market remained operational.

The team chose freezes rather than full contract pauses, preserving several essential functions for existing positions. Its account also clarifies the governance trade-off: the approximately five-day delay associated with supply-cap changes concerned restoring caps after reductions, not an unavoidable wait to lower them initially.

Restrictions bring pressure for existing borrowers

Keeping repayments and withdrawals open limited the disruption, but freezing a reserve also prevents users from supplying additional collateral. Withdrawals remain dependent on available liquidity and the health of a user’s position; an open withdrawal function does not mean every depositor can immediately remove all funds.

A subsequent Oct. 30 risk-steward proposal reported utilization of 92%–100% in major stablecoin reserves and elevated borrowing rates. It proposed temporary interest-rate adjustments to mitigate that pressure. The proposal illustrates how defensive restrictions can affect users even without a direct exploit of the lending protocol.

Aave’s incident account also reported declines in tokens the attacker sold, including AAVE and LINK, and a brief move in its GHO stablecoin to $0.997 alongside 4.6 million GHO redeemed for USDT through its stability module. These were reported observations, not a synchronized market snapshot establishing that every price move had the same cause.

Binance’s commitments and unresolved questions

According to Bitcoin.com’s report, Binance said investigators had identified additional points of compromise beyond a potentially compromised laptop and were working with law enforcement. Those statements describe preliminary findings, not a completed determination of the attack’s root cause.

The exchange also reported that partners had frozen approximately $3 billion in affected assets. Freezing assets is distinct from recovering them or returning them to customers. Binance pledged to cover losses through its Secure Asset Fund for Users and company funds, but that commitment does not establish that reimbursements had been completed.

Binance said unauthorized outflows stopped after withdrawals were suspended, deposits remained unaffected, and withdrawal restoration was expected within an approximately 45-hour window. The supplied evidence does not establish a completed reopening or provide a sufficiently clear announcement timestamp to calculate a firm deadline.

Aave’s response team described a conditional, staged restoration dependent on clearer Binance containment and stabilization of attacker activity. The later interest-rate proposal documents continuing mitigation, not confirmation that markets had reopened. The final breach mechanism, the amount ultimately recoverable and the timing of full service restoration remained unresolved in the available accounts.