Elon Musk

Monad

Core

Aave

<a href="https://www.thestreet.com/crypto/tag/aave" rel="noopener noreferrer nofollow">Aave</a>, a platform where people lend and borrow crypto, began reopening some lending markets Friday after tightening borrowing limits and cutting interest-rate settings.
The reopening follows a freeze on 292 reserves, or pools of individual cryptocurrencies available for lending. Aave imposed the restrictions after <a href="https://www.thestreet.com/crypto/markets/how-much-of-binances-emergency-fund-is-available" rel="noopener noreferrer nofollow">money was stolen</a> from <a href="https://www.thestreet.com/crypto/tag/binance" rel="noopener noreferrer nofollow">Binance</a>, the world's largest crypto exchange.
Records on the blockchain, the public ledger of crypto transactions, show pools reopening from 8:21 a.m. ET on Aave V3 and 8:56 a.m. ET on Aave V4. Those are two versions of the lending system.
<a href="https://www.thestreet.com/crypto/markets/im-with-elon-musk-on-binances-hack" rel="noopener noreferrer nofollow">Related: I'm with Elon Musk on Binance's hack</a>
Aave is part of decentralized finance, or DeFi: financial services run through computer programs on crypto networks rather than a bank. People <a href="https://aave.com/help/supplying/supply-tokens" rel="noopener noreferrer nofollow">supply</a> crypto to shared pools to earn interest; borrowers pay interest to use those funds.
<a href="https://aave.com/help/borrowing/borrow-tokens" rel="noopener noreferrer nofollow">Borrowers</a> must first put up crypto worth more than the loan as security. That security is called collateral, and it can be sold if it no longer provides enough backing for the debt.
Watch Mehab Qureshi, senior editor at TheStreet, decode the Binance hack:
<figure>
 <figcaption>
 How did hackers drain $6.3 billion from Binance in about 20 minutes (3:39)
 </figcaption>
</figure>
<h2 id="what-reopened">What reopened</h2>
The LlamaRisk <a href="https://dashboard.llamarisk.com/protocols/aave/risk-parameter-updates/v3" rel="noopener noreferrer nofollow">dashboard</a>, which tracks changes to Aave, logs transactions lifting the freeze on V3 pools on at least 14 of the 16 crypto networks affected. Each network is a separate system for recording and processing transactions.
Arbitrum was first at 8:21 a.m. ET, followed by Ethereum Core at 8:26 a.m. The latest V3 entries reviewed, on X Layer, are stamped 8:53 a.m.
V4 entries run from 8:56 to 9:23 a.m. ET. They cover lending markets called spokes, including Main, Gold, Forex, Ethena and Mag-7.
The entry for Prime, another Aave market, matches an Ethereum <a href="https://etherscan.io/tx/0xcfa0db91442106bc0403c6f21a6d1c869999d33097ea2547cd523967f5faaa1b" rel="noopener noreferrer nofollow">transaction</a> confirmed at 8:52:11 a.m. ET.
As of the 9:27 a.m. ET check, the Aave posts reviewed did not describe the reopening. The records also did not establish whether every pool had reopened.
<figure>
 <figcaption>
 Stani Kulechov, founder of Aave Labs, during the DC Blockchain Summit in Washington, DC, US, on Tuesday, March 17, 2026. 
 Getty Images
 </figcaption>
</figure>
<h2 id="borrow-caps-cut-first">Borrow caps cut first</h2>
Before pools reopened, Aave's Risk Steward process, which allows designated teams to adjust risk settings, cut borrowing limits on 27 V3 pools. The dashboard records those changes between 7:11 and 7:49 a.m. ET.
LlamaRisk, a risk adviser to Aave, had <a href="https://governance.aave.com/t/risk-stewards-borrow-and-draw-cap-reductions-on-aave-v3-and-aave-v4-2026-10-30/25960/1" rel="noopener noreferrer nofollow">recommended</a> limits roughly 2% above borrowing before the hack, or current debt where that was higher. Its plan removes about $3.7 billion of unused borrowing capacity on V3 and $130 million on V4, reducing how much extra crypto users could borrow after reopening.
For example, the limit for USDT on Ethereum Core is now 2.56 billion tokens. USDT is a stablecoin, a cryptocurrency designed to track the U.S. dollar.
LlamaRisk's 4:52 a.m. ET snapshot showed about 2.47 billion USDT already borrowed. That left room for roughly 89 million more tokens in loans.
Several V4 draw caps, which limit borrowing through its credit lines, were cut at 7:17 and 7:33 a.m. ET. These limits restrict new borrowing; they do not force existing borrowers to repay immediately.
<h2 id="rate-cuts-followed-the-spike">Rate cuts followed the spike</h2>
The freeze also made some loans more expensive. With new deposits blocked, withdrawals left 92% to 100% of the money supplied to the largest pools already lent out by 8:26 p.m. ET Thursday, LlamaRisk said.
That share is called utilization. Aave raises borrowing rates when a pool is heavily used, so a shrinking supply of available funds can mean a higher interest bill for borrowers.
On the Monad network, Aave V3 borrowing rates reached 20.2% for USDC and 36.1% for mUSD, according to <a href="https://governance.aave.com/t/risk-stewards-temporary-slope2-reductions-on-aave-v3-and-aave-v4-2026-10-30/25955/1" rel="noopener noreferrer nofollow">LlamaRisk's</a> table. Both are stablecoins, and the percentages express the cost of borrowing over a year, not charges for a single day.
Risk Steward transactions then lowered Slope2, the setting that makes borrowing rates rise sharply when little money is left in a pool. Those V3 changes ran from 9:52 p.m. Thursday to 4:28 a.m. ET Friday.
Not every change matched the proposal. For GHO, Aave's dollar-linked stablecoin, on the Plasma network, the Slope2 setting fell to 11.5%, rather than the proposed 5.25%. That setting alone is not the interest rate a borrower pays.
LlamaRisk's own table also showed some proposed rates above its 10% goal if all supplied funds were borrowed: 20% for the DAI stablecoin, 34% for the dollar-linked USDtb token and 25% for mUSD on Monad. These figures describe rates at full utilization, not what every borrower was paying.
The reviewed records do not establish current borrowing rates. Those rates change as people deposit, withdraw, borrow and repay, including as pools reopen.
<a href="https://www.thestreet.com/crypto/innovation/coinbase-ceo-wants-to-kill-monthly-subscriptions-one-article-at-a-time" rel="noopener noreferrer nofollow">Related: Coinbase CEO wants to kill monthly subscriptions, one article at a time</a>
<h2 id="the-link-to-the-binance-hack">The link to the Binance hack</h2>
At 4:24 p.m. ET Thursday, a Binance hot wallet sent 167,464 ether and about 63 other tokens to one address, <a href="https://governance.aave.com/t/binance-hot-wallet-exploit-aaves-response/25954" rel="noopener noreferrer nofollow">LlamaRisk</a> said. A hot wallet is an internet-connected account used to move crypto; ether is the cryptocurrency of the Ethereum network.
From 4:58 to 5:01 p.m. ET, an account linked to the attacker supplied $60 million of USDT to Aave V3 Ethereum Core. It then borrowed 19,762 WETH, worth about $44.6 million at the time; WETH is a version of ether used by lending programs.
That happened about 40 minutes before the first freeze. LlamaRisk said no account in the linked group had used Aave since 5:01 p.m. ET Thursday.
In LlamaRisk's snapshot, that loan had $59.9 million of collateral backing $43.8 million of debt. The security was worth more than the debt, and LlamaRisk said the position did not put people who supplied crypto to Aave at risk.
Binance's own <a href="https://www.binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7" rel="noopener noreferrer nofollow">announcement</a> puts the hack's impact at about $6.3 billion, with about $3 billion frozen on-chain. Here, frozen means transfers of those assets have been blocked, not that the money has already been returned.
<h3 id="more-on-binance-hack">More on Binance hack:</h3>
<ul>
 <li><a href="https://www.thestreet.com/crypto/markets/binance-major-shareholder-says-user-funds-are-safe-after-reported-2-5b-hack" rel="noopener noreferrer nofollow">Binance major shareholder says user funds are safe after $3B hack</a></li>
 <li><a href="https://www.thestreet.com/crypto/markets/binance-cites-1b-spacex-stake-after-elon-musk-mocks-hack" rel="noopener noreferrer nofollow">Binance major shareholder cites $1B SpaceX stake after Elon Musk mocks hack</a></li>
 <li><a href="https://www.thestreet.com/crypto/markets/how-much-of-binances-emergency-fund-is-available" rel="noopener noreferrer nofollow">How much of Binance's emergency fund is available?</a></li>
</ul>
<h2 id="who-was-affected">Who was affected</h2>
People lending or borrowing in the frozen Aave pools faced the restrictions even if they had never used Binance. The disruption spread because the attacker had used Aave after taking funds from the exchange.
During the freeze, users could repay loans and withdraw available funds, but could not add collateral or take out new loans. Liquidations continued: collateral could still be sold to repay a loan if its backing fell below the required level.
Because users could not add collateral to frozen pools, repaying debt was their way to improve a loan's safety margin. The reviewed records do not say how many borrowers or lenders were affected.
<h2 id="the-roundtable-100">The Roundtable 100</h2>
If you follow our market coverage, don’t miss the <a href="https://roundtable100.com/tab/rankings" rel="noopener noreferrer nofollow">Roundtable 100</a>. Updated every Friday, it's a power ranking of the 100 most investable tech stocks, including digital assets. Check out the latest <a href="https://roundtable100.com/" rel="noopener noreferrer nofollow">RTB 100</a> rankings at <a rel="noopener noreferrer nofollow">roundtable100.com</a>
<a href="https://www.thestreet.com/crypto/markets/varonis-systems-jumps-52-places-on-the-roundtable-100" rel="noopener noreferrer nofollow">Related: Varonis Systems jumps 52 places on the Roundtable 100</a>

Major DeFi lender Aave reopens after Binance hack

Table of Contents

TheStreet Roundtable

Other articles published on Oct 31, 2026

Join our free newsletter for daily crypto updates!