Aave reopens markets in stages after emergency Binance-related freeze

Aave’s response to the October 29 Binance theft has moved from a broad emergency freeze toward a staged reopening, with some stablecoin collateral restrictions still in place. The lending protocol initially froze 292 reserves after an attacker-linked wallet deposited USDT and borrowed wrapped ether.

The incident originated at Binance rather than in an identified exploit of Aave’s contracts. It nevertheless exposed how assets stolen from a centralized exchange can reach decentralized credit markets before a coordinated response is complete.

An attacker borrowed before guardians acted

LlamaRisk’s incident timeline records an attacker-linked wallet supplying 60 million USDT to Aave V3’s Ethereum Core market between 20:58 and 21:01 UTC on October 29. It borrowed 19,762 WETH, worth approximately $44.6 million at the time.

The position was overcollateralized in the response team’s initial assessment. That assessment concerned its condition at the observation time, rather than guaranteeing its health as debt, asset prices and interest changed.

Guardian transactions executed between 21:42 and 23:04 UTC froze 175 V3 reserves across 16 networks and 117 V4 reserves across four networks. The permissioned Horizon market remained open. A freeze blocked new supplies and borrowing while leaving repayments, withdrawals and liquidations functioning, subject to each position’s conditions and available liquidity.

The breadth of the action reflected concern that the attacker could exchange stolen tokens into other assets accepted as collateral. Freezing only the original stolen tokens would have left alternative routes available.

Reopening comes with tighter borrowing controls

On October 30, service providers outlined a four-wave rollback. The plan reopened supply and borrowing while temporarily preventing selected assets from adding new borrowing power, using zero loan-to-value ratios on V3 and zero collateral factors on V4.

Risk stewards also reduced unused borrowing capacity and temporarily adjusted interest-rate curves. Those measures addressed a consequence of the freeze: withdrawals could raise reserve utilization, while blocked deposits prevented new supply from relieving pressure.

By November 2, LlamaRisk said Binance withdrawals had resumed and the resulting outflows had stabilized. Aave’s guardians restored earlier collateral settings for selected non-stablecoin assets, including specified AVAX-related and gold-token reserves. Temporary interest-rate changes had been reversed on November 1.

Stablecoin collateral remains the unresolved step

In the November 2 update, USDT, USDC and USDT0, including bridged versions, remained unable to add borrowing power under the temporary settings. The team said restoring those assets’ collateral parameters was a subsequent decision, while monitoring of attacker wallets and price feeds continued.

The progression shows why the original freeze count should be read as an emergency action, not a current claim that 292 reserves remain closed. It also separates reopening routine market functions from restoring every collateral privilege. Existing borrowers can still experience meaningful restrictions even after the broadest phase of an emergency has ended.