Key Insights:
- Aave crypto froze 292 reserves after a Binance-linked wallet borrowed 19,762 WETH.
- The freeze blocks new deposits and borrowing; withdrawals and repayments remain available.
- LlamaRisk said the loan remains overcollateralized and subject to normal liquidation.
Aave crypto markets froze 292 reserves after a wallet linked to the Binance hack borrowed WETH against USDT collateral. The wallet supplied 60 million USDT to Aave V3 Ethereum Core and borrowed 19,762 WETH on October 29. LlamaRisk valued the loan at about $44.6 million when it was opened. Aave’s first freeze followed roughly 40 minutes later.
The restrictions block new deposits and borrowing across affected reserves, but users can still withdraw and repay. Liquidations also continue. LlamaRisk said the position remains overcollateralized and does not put Aave suppliers at risk. The freeze covers 175 V3 reserves and 117 V4 reserves.
Aave Crypto Position Remains Backed by $59.9 Million in USDT
At 20:24 UTC on October 29, a Binance hot wallet sent approximately 63 tokens and 167,464 ETH to a single address. The same address later received another 28,006 ETH from a second Binance hot wallet.
Funds also moved on Arbitrum, Optimism, and Avalanche. A further 444,537 AVAX arrived on Avalanche at 23:04 UTC, according to LlamaRisk.
The exploiter spread funds across more than 20 new wallets and sold tokens, including UNI, LINK, and AAVE, for ETH. One wallet in that cluster then used Aave crypto lending on Ethereum Core between 20:58 and 21:01 UTC. It supplied 60 million USDT and borrowed 19,762 WETH.
LlamaRisk identified this as the cluster’s only Aave position across all networks and versions. Its update listed about $59.9 million of USDT collateral against $43.8 million of debt. The position remains subject to normal liquidation. LlamaRisk recorded no further Aave interaction by the cluster after 21:01 UTC.
Why Aave Crypto Froze V3 and V4 Reserves Across Networks
LlamaRisk joined Aave Labs, TokenLogic, and Certora in a joint response within 10 minutes of the first reports. The group chose a broad freeze because the exploiter could exchange the funds for any asset listed on Aave. Restricting only the tokens initially taken from Binance would leave other listed reserves available.
Guardian multisigs executed the freeze transactions between 21:42 and 23:04 UTC. Aave crypto restrictions covered 175 V3 reserves across 16 networks and 117 V4 reserves across four networks. V3 markets included Ethereum Core and Prime, Arbitrum, Avalanche, Base, BNB Chain, Optimism, and Polygon. V4 coverage included Ethereum, Avalanche, Base tokenized equities, and Arc spokes.
The Horizon RWA market stayed open because its collateral is permissioned. Aave did not pause any market. A freeze prevents new supply and borrow positions, while withdrawals, repayments, and liquidations remain available. Users cannot add collateral to frozen reserves, so repaying debt is the available way to raise a position’s health factor.
Binance Hack Fallout Puts Token Prices and GHO in Focus
Binance estimated the reported crypto hack’s total impact at about $6.3 billion and reported roughly $3 billion frozen on-chain. Its preliminary investigation pointed to a compromised DevOps engineer’s laptop and unauthorized withdrawal transactions. Binance said it found no evidence that wallet private keys leaked. It temporarily suspended deposits and withdrawals and pledged to cover losses with its SAFU fund and company funds.
At 00:55 UTC on October 30, LlamaRisk said ETH and BTC were about 4% lower than before the drain. AAVE and LINK were down about 9%, UNI about 8%, and ARB about 6%. It reported that Chainlink oracle feeds were working normally and existing positions backed by those tokens remained healthy.
GHO edged from about $0.998 to $0.997 as holders redeemed approximately 4.6 million GHO for USDT. Those redemptions occurred between 21:49 and 22:07 UTC through the GHO Stability Module. Aave crypto markets will remain frozen until the funds stop moving and Binance provides more clarity on containment. LlamaRisk said it would then work with other service providers on a staged unfreeze.
