Guardian

Core

Aave

WETH

<ul>
 <li>A wallet linked to the Binance exploit supplied 60 million USDT to Aave V3 Ethereum Core and borrowed 19,762 WETH, worth about $44.6 million at the time, against that collateral</li>
 <li>Guardian multisigs froze 175 reserves across 16 networks on Aave V3 and 117 reserves across four networks on Aave V4 between 21:42 and 23:04 UTC</li>
 <li>Aave says the borrow position remains over-collateralized, with $59.9 million of USDT collateral against $43.8 million of debt, and that freezing was chosen over cutting supply caps because a governance vote would have taken about five days</li>
</ul>
Aave’s own governance forum published a detailed account of how the Binance hack reached its protocol within minutes of the exploit beginning. At 20:24 UTC on October 29, 2026, a Binance hot wallet on Ethereum sent about 167,464 ETH plus 63 other tokens to a single address in one transaction, and the same address shortly received a further 28,006 ETH from a second Binance hot wallet, along with funds that moved separately on Arbitrum, Optimism and Avalanche.
Between 20:58 and 21:01 UTC, a wallet tied to the exploiter cluster supplied 60 million USDT to Aave V3 Ethereum Core and borrowed 19,762 WETH against it, worth roughly $44.6 million at the time. According to Aave’s forum post, that remained the exploiter’s only interaction with the protocol across any network or version, and the position is over-collateralized, with $59.9 million of USDT backing $43.8 million of outstanding debt, meaning it remains subject to normal liquidation rules rather than posing a direct loss risk to Aave’s suppliers.
Aave Labs, risk manager TokenLogic and security firm Certora formed a response group within about ten minutes of the first reports and chose to freeze markets broadly rather than cut individual supply caps, since a cap reduction requires a governance vote that typically takes around five days to complete. Guardian multisigs executed the freezes between 21:42 and 23:04 UTC, covering 175 reserves across 16 networks on Aave V3 and 117 reserves across four networks on Aave V4. A freeze blocks new supply and new borrowing on an affected reserve while leaving withdrawals, repayments and liquidations unaffected. Aave’s Horizon real-world-asset market, which uses permissioned collateral, was left open throughout.
The stablecoin GHO briefly slipped from about $0.998 to $0.997 as the incident unfolded, and roughly 4.6 million GHO was redeemed for USDT through the GHO Stability Module between 21:49 and 22:07 UTC. A second inflow of 444,537 AVAX arrived on Avalanche at 23:04 UTC, which Aave’s post describes as a sign the underlying compromise was still active at that point, coinciding with when freeze execution finished. By 00:55 UTC on October 30, several governance and infrastructure tokens including AAVE, LINK, UNI and ARB were down between roughly six and nine percent since the drain began.
The <a href="https://governance.aave.com/t/binance-hot-wallet-exploit-aaves-response" rel="noopener noreferrer nofollow">full timeline is published on Aave’s own governance forum</a>, which the protocol has used as its primary channel for updates throughout the incident.
This post first appeared in <a rel="noopener noreferrer nofollow" href="https://cryip.co/aave-freezes-reserves-across-16-networks-after-the-binance-hack-reaches-its-markets/">Aave Freezes Reserves Across 16 Networks After the Binance Hack Reaches Its Markets</a>

Aave Freezes Reserves Across 16 Networks After the Binance Hack Reaches Its Markets

CRYIP

Other articles published on Oct 30, 2026

Join our free newsletter for daily crypto updates!