# Aave market freezes over Binance-exploiter loan (USDT collateral / WETH borrow): Aave froze V3/V4 markets after a Binance-exploiter wallet borrowed ~$44.6M ETH against $60M USDT Source page: https://vaultx.llc/hacks/aave-market-freeze-october-2023 · VaultX incident report by Sentinel · first published 2026-10-31, updated 2026-10-31 - Date: 2026-10-29 - Reported loss: $44.6M (Reported: about $60M USDT collateral and about 19,762 WETH (about $44.6M) borrowed; the position was reportedly overcollateralized, so not an immediate loss to Aave suppliers. The wider Binance exploit was described by the WSJ as about $2.4B in 'un-freezable' assets escaping. That figure is the Binance theft, not an Aave loss.) - Attribution: A wallet 'linked to the Binance hot-wallet exploiter' (Binance-linked attacker), per multiple outlets. It is not independently confirmed as a named person or group. - Chains: Ethereum - Status: contained - Severity: 66/100 - Response score: 72/100 (Aave published a governance post and froze markets about 40 minutes after the position opened, while keeping withdrawals and repayments open. The freeze was broad, the attacker's loan was not blocked beforehand, and no postmortem or follow-up is confirmed in the research.) On 29 Oct 2026 a wallet reportedly linked to the Binance hot-wallet exploiter deposited about $60M USDT into Aave V3 Ethereum Core and borrowed 19,762 WETH (about $44.6M). Aave froze new deposits and borrows across its DAO-operated V3 and V4 markets as a containment step, and said its smart contracts were not compromised. Existing users could still withdraw, repay and be liquidated. The episode shows how stolen stablecoins, which an issuer can freeze, can be converted into ETH, which cannot be frozen, through a normal DeFi loan. **What happened** According to the Aave governance forum post and press coverage, a wallet linked to the Binance hot-wallet exploiter deposited about $60 million in USDT into Aave V3 Ethereum Core and borrowed 19,762 WETH, worth roughly $44.6 million at the time. Reporting says the position was opened in a three-minute window between 20:58 and 21:01 UTC on 29 October 2026, and that it was the exploiter's only position on Aave. About 40 minutes later Aave began freezing new deposits and borrows across its DAO-operated V3 and V4 markets, between 21:42 and 23:04 UTC. According to blockchainreporter.net, the freezes covered 175 Aave V3 reserves across 16 networks and 117 Aave V4 reserves across four networks. Existing users could still withdraw, repay and be liquidated. Per a LlamaRisk-linked report quoted in Binance coverage, the Horizon RWA market was not frozen because its collateral is permissioned. Aave said its smart contracts were not compromised. The Aave position was reported as about $60M USDT collateral against about $43.8M ETH debt. The underlying Binance exploit is separate and far larger: the WSJ reported about $2.4 billion in 'un-freezable' crypto assets escaping. **How it worked** The mechanism was a standard overcollateralized DeFi borrow, not a bug in Aave. Per crypto.news, Crypto Times and the WSJ, the attacker supplied stolen USDT as collateral and borrowed ETH against it. The reported reason is that ETH cannot be frozen by a stablecoin issuer, so value moves from a freezable asset into a far more censorship-resistant one. Crypto Times described this as Aave being used like a 'crypto mixer'. That is the outlet's characterization, not a technical finding about Aave. The borrower keeps the debt open, and the stablecoin collateral stays in the protocol. **Where the money went** Stolen USDT was reportedly deposited into Aave V3 Ethereum Core as collateral (about $60M), and about 19,762 WETH (about $44.6M) was borrowed against it. The research does not establish where the borrowed ETH went next, such as mixers, bridges or exchanges. It also does not show any on-chain freezing or recovery of the attacker's funds, beyond Aave's protocol-level restrictions on new deposits and borrows. **The response** According to the Aave governance forum post, Aave froze new deposits and borrows across its DAO-operated V3 and V4 markets as a containment step. Withdrawals, repayments and liquidations stayed enabled, and Aave stated its smart contracts were not compromised. The Horizon RWA market was not frozen. No compensation, insurance-fund use or regulator/police action was found in the research. **Impact** Reported direct impact on Aave is limited: the position was overcollateralized, so suppliers faced no immediate loss. Users on 16 networks lost the ability to supply or borrow in frozen reserves for a period. Withdrawals, repayments and liquidations continued. The episode drew scrutiny over whether lending protocols should allow stolen funds to be used as collateral and borrowed against. The wider Binance exploit is reportedly about $2.4B. **Timeline** - 2026-10-29 20:58 UTC Reportedly the start of a three-minute window (to 21:01 UTC) in which the Binance-exploiter-linked wallet deposited about $60M USDT into Aave V3 Ethereum Core and borrowed 19,762 WETH. - 2026-10-29 21:42 UTC Aave begins freezing new deposits and borrows on DAO-operated V3 and V4 markets, about 40 minutes after the position was opened. - 2026-10-29 23:04 UTC End of the reported freeze window (21:42-23:04 UTC) across 175 V3 reserves on 16 networks and 117 V4 reserves on four networks. - 2026-10-30 Crypto Times and other outlets publish analyses of how Aave was used in the Binance hack laundering path. **How to protect yourself** - Users: a freeze of new supply and borrowing is not a shutdown. Check whether withdraw and repay remain enabled before assuming funds are locked. - Users: if you borrow on Aave, watch your health factor during market stress, since liquidations stay active during freezes. - Builders and DAOs: stolen-fund conversion can happen through ordinary overcollateralized borrowing. Consider monitoring and rapid-response playbooks for flagged wallets. - Builders: permissioned-collateral markets, as reportedly in Aave Horizon, limit exposure to this vector. - Treat single-source figures such as USD values and borrowed amounts as reported until confirmed on-chain. **Still unknown** - The exact attacker wallet addresses are not in the research, so none are listed. - Where the borrowed 19,762 WETH went after the loan is unknown. - It is unclear whether and when the freezes were lifted, and whether Aave published a postmortem. - The research includes a block describing a 4 November 2023 Aave V2 pause and V3 asset freezes on Polygon, Arbitrum and Optimism, with 'no funds at risk'. It conflicts with the 29 Oct 2026 incident and appears to describe a different or mis-dated event, so it was not used. The case title's 'October 2023' conflicts with the 2026 dates in the reporting. - Attribution to the Binance exploiter rests on media reports and has not been independently confirmed. - Whether Aave suppliers or the protocol face any bad-debt risk if ETH prices rise sharply is not addressed in the research. **Sources** - Aave governance: Binance hot wallet exploit, Aave's response https://governance.aave.com/t/binance-hot-wallet-exploit-aaves-response/25954 - crypto.news: Aave market freezes, Binance hacker USDT/ETH loan https://crypto.news/aave-market-freezes-binance-hacker-usdt-eth-loan/?referrer=www.coinrithm.com/es/criptomonedas/aave - Crypto Times: How Aave was used as a crypto mixer in the Binance hack https://www.cryptotimes.io/2026/10/30/how-aave-was-used-as-a-crypto-mixer-in-binance-hack-attacker-borrowed-44-6m-in-eth-against-60m-usdt/ - Blockchain Reporter: Aave freezes V3/V4 markets, Binance exploiter https://blockchainreporter.net/aave-freezes-v3-v4-markets-binance-exploiter/ - Wall Street Journal: Behind the scenes of crypto's biggest nightmare https://www.wsj.com/finance/currencies/behind-the-scenes-of-cryptos-biggest-nightmare-a-record-breaking-cyber-heist-ffe1d9a3 - Binance Square post (LlamaRisk-linked report) https://www.binance.com/en/square/post/382781729191381 - Wu Blockchain on X https://x.com/WuBlockchain/status/2116061415480111186/photo/1 --- VaultX: free crypto news and intelligence, https://vaultx.llc