Aave Freezes 292 Reserves Across 16 Networks After Binance Hot Wallet Hack

Emergency Freeze Across 16 Networks

Aave suspended new deposits and borrowing across 292 reserves on 16 blockchain networks on Thursday, an emergency freeze triggered by the theft of more than 195,000 ETH from Binance hot wallets. The Aave price fell about 9% as stolen tokens began moving onto decentralized exchanges, and the freeze also blocks the fresh deposits that feed yield farming strategies across the protocol. Aave is a decentralized money-market protocol where lenders supply assets that borrowers can draw against by posting collateral. The Aave team's incident report traces the breach to 15:24 Eastern Time on October 29, when a single transaction moved 167,464 ETH and 63 other tokens out of an Ethereum-based Binance hot wallet to an unknown address. Minutes later, the same attacker drew a further 28,006 ETH from a second Binance wallet, along with transfers routed through Arbitrum, Optimism and Avalanche. Reported inflows continued past 17:04 ET, when 444,537 AVAX arrived over Avalanche, an indication the exploit stayed open for more than two hours. On-chain records show the attacker dispersed the funds across more than 20 wallet addresses and began selling Uniswap (UNI), Chainlink (LINK) and AAVE for ETH on decentralized exchanges. Tokens the attacker sold directly took the hardest falls, and Chainlink dropped 9% alongside AAVE. The guardian multisignature wallets executed the shutdown between 16:42 and 18:04 ET, pausing 175 reserves on Aave V3 across 16 networks and 117 reserves on Aave V4 across four networks, with Ethereum, Arbitrum, Avalanche, Base, Optimism, Polygon and BNB Chain among the affected markets. The permissioned Horizon real-world asset market stayed live, and the team avoided a full contract pause. Existing users can still repay debt and withdraw collateral; only new supply and new borrowing are blocked.

Binance Response and Market Fallout

Between 15:58 and 16:01 ET on Thursday, before the protections went live, a wallet linked to the attacker deposited $60 million in USDT into Aave V3 on Ethereum Core and borrowed 19,762 wrapped ETH (WETH), worth about $44.6 million at the time. The incident report states the position remains overcollateralized, with $59.9 million in USDT collateral backing roughly $43.8 million in debt, so it poses no immediate insolvency risk to liquidity providers and stays subject to standard liquidation rules. Aave Labs, Tokenlogic, Certora and partner security firms formed a joint response team within ten minutes of the first report. Rather than pausing single reserves or waiting out a five-day community governance vote to cut supply caps, guardians imposed a global freeze to keep the attacker from parking stolen tokens in other pools. Binance said about $3 billion in affected assets have been frozen with partners' help and that unauthorized outflows stopped once withdrawals were suspended; deposits are unaffected and the exchange still expects to restore withdrawals within its earlier 45-hour window. It pledged to cover all losses from the user asset protection fund (SAFU) and company funds, and its official update on X called the incident a “sophisticated attack,” said the exchange is working closely with law enforcement, and noted that investigators found additional intrusion points beyond the possibly compromised laptop first suspected. The fallout hit the wider market hard: Bitcoin dropped to $76,320 and Ethereum to $2,170, while UNI lost 8% and ARB 6%. Aave's GHO stablecoin briefly slipped to $0.997 after users redeemed $4.6 million through the stability module. Protocol engineers said markets will stay frozen until Binance publishes further control updates and attacker wallet activity stabilizes, with a phased lifting of restrictions to be assessed once both conditions hold.

Attacker Funds Still Traceable On-Chain

The on-chain record supports the containment view: the three largest movements, 167,464 ETH, 28,006 ETH and 444,537 AVAX, are each verifiable on their home chains, and the attacker's borrowed position checks out against Aave's own accounting, with collateral still exceeding debt. COINOTAG's live monitoring shows spot down about 5.5% over the past 24 hours, a shallower loss than the initial sell-off; the freeze itself has not moved since the guardians finished on Thursday evening. Exchange-side pressure continues, with Binance set to remove 12 spot pairs including AAVE on October 30 and V4's newly added externally curated lending markets now behind the pause. What has not been counted yet is Binance's final loss figure, which the exchange says will follow as investigators verify more. Anyone still interacting with pools under the restrictions should do their own research (DYOR).