Aave Reopens Lending Markets After Binance Hack, Nine Assets at Zero LTV

Markets Reopen, Nine Tokens Restricted

Aave reopened every lending market on V3 and V4 on Friday, October 30, ending a precautionary freeze imposed after attackers drained roughly $6.3 billion from Binance's hot wallets. The Aave price never entered the incident itself: the update the protocol published on October 30 states that all markets have resumed full operations, that no contract was affected and that every position stayed fully secured. One restriction survives the restart. Nine assets, USDT, USDC, USDT0, POL, WAVAX, sAVAX, XAUT, PAXG and OP, together with their wrapped and bridged forms, carry a zero loan-to-value ratio on V3 and a zero collateral factor on V4, as LlamaRisk set out in its October 30 response. Wrapped and bridged variants fall under the same rule, a recognition that wrapping does not change the underlying exposure. The list groups the stablecoins the hackers actually spent with two tokenized gold assets, XAUT and PAXG, so collateral vetting now reaches past stablecoins into real-world assets. A zero loan-to-value setting in practice means a deposit can still earn and be withdrawn but can no longer secure new debt. Suppliers keep full access: users of the restricted assets can deposit, withdraw, borrow and repay as before, and only their role as collateral for new loans is blocked. Existing V3 positions are untouched and keep their liquidation thresholds and health scores. On V4, where externally curated lending markets arrived with Sentora, collateral parameters hold until a borrower draws more, removes collateral or changes an asset's collateral status. The restart also unwinds the emergency step that left 292 reserves across 16 networks suspended when the exploit surfaced.

@aave · X post

Published on October 30.

View on X

How Stolen USDT Became a WETH Loan

The borrowing that forced the freeze began on October 29. Between 20:58 and 21:01 UTC, a wallet tied to the attackers deposited 60 million USDT into Aave V3 Ethereum Core and drew roughly 19,762 WETH, worth about $44.6 million at the time. Aave halted the markets at 21:42 UTC that evening: new deposits and borrowing stopped, while withdrawals, repayments and liquidations stayed open. LlamaRisk's October 30 report valued the assets in that position at $59.9 million against $43.8 million of debt, which left the loan overcollateralized and suppliers with no exposure to loss. The freeze then produced pressure of its own. Suppliers could pull funds while new deposits were shut, and utilization in the largest stablecoin pools reached 92% to 100%, by LlamaRisk's October 30 analysis. High borrowing rates normally pull fresh deposits in; with reserves frozen they only added to borrowers' debt, so risk stewards cut Slope2, the steep end of Aave's rate curve that rations liquidity at high utilization. That matters because Aave sets rates by pool utilization, a mechanism distinct from the automated market maker pricing used on decentralized exchanges, so a frozen reserve cannot bid for deposits. A further adjustment tightened borrowing limits, stripping $3.7 billion of unused capacity on V3 and $130 million on V4 before the guardians reopened markets in four waves. The breach behind it all dwarfs the borrowing operation. Elliptic's October 30 analysis put total losses at $6.43 billion, more than four times the $1.46 billion taken from Bybit in 2025. Binance's own October 30 announcement says about $3 billion of the stolen funds are frozen on-chain and that losses will be covered from its SAFU reserve and corporate funds. Trading conditions frayed elsewhere: GSR, a market maker, saw Bitcoin spreads widen to five times their normal level, with Ether spreads at 2.5 times normal, and the fallout reached listings through Binance's removal of 12 BTC spot pairs, AAVE among them, set for October 30.

Losses Stayed at Zero

The record shows no Aave loss anywhere in this episode. The attacker's collateral held $59.9 million against $43.8 million owed, so the damage ran through liquidity and borrowing limits rather than through the ledger. The zero-LTV restriction on nine assets, led by the very stablecoins the hackers spent, closes the door they used, and the $3.83 billion of capacity cuts buys insulation at the cost of open borrowing room. Our reading is that the four-wave restart was deliberate risk pacing rather than a technical necessity: guardians brought markets back in stages so utilization could settle before full collateral access returned. Binance's announcement stands as the last word on the stolen funds: roughly $3 billion frozen on-chain, coverage promised from its SAFU reserve and corporate funds, and freezing an asset on-chain is not the same as recovering it.