Aave froze every DAO-operated market across its V3 and V4 deployments late on October 29 after a wallet in the Binance exploiter’s cluster used the protocol to borrow against $60 million of USDT. The freeze is a containment decision, not a response to a vulnerability in Aave’s own code, and it shows how a large lending protocol reacts when stolen funds from a centralized exchange arrive at its doors.
Between 20:58 and 21:01 UTC, one wallet supplied 60 million USDT on Aave V3 Ethereum Core and borrowed 19,762 WETH, worth about $44.6 million at the time. Roughly forty minutes later, at 21:42 UTC, the protocol’s guardians began freezing markets. LlamaRisk, the protocol’s risk steward, wrote that the position holds $59.9 million of USDT collateral against $43.8 million of debt, that it is over-collateralized and subject to normal liquidation, and that it does not put Aave suppliers at risk. It is the exploiter’s only position on Aave across all networks and versions, and no exploiter wallet has interacted with the protocol since 21:01.
The freeze is blunt by design. It stops anyone, including the exploiter, from opening new supply or borrow positions, while repayments, withdrawals, and liquidations keep running. The stewards chose it over cutting supply caps because a freeze can be reversed by the guardians immediately, whereas a cap change would require a governance vote and roughly five days to restore. Because the exploiter could have swapped stolen funds into any listed asset, freezing only the reserves that held the stolen tokens would have left other entry points open.
Within ten minutes of the first reports, LlamaRisk joined Aave Labs, TokenLogic, and Certora in a war room, and the guardian multisigs executed the freezes between 21:42 and 23:04 UTC. In total, 175 reserves were frozen on Aave V3 across 16 networks and 117 on Aave V4 across four networks. The Horizon RWA market stayed open because its collateral is permissioned and cannot be used by the exploiter.
The next move shrank the borrowing runway. On October 30, LlamaRisk published a separate proposal to cut borrow caps on the largest V3 reserves and draw caps on V4 credit lines to about 2 percent above the amount borrowed just before the exploit. The reductions remove billions of dollars of unused borrowing capacity and target reserves with more than $10 million borrowed and more than $10 million of capacity still available.
What the episode does not show is a flaw in Aave. The protocol’s contracts were never exploited. The attacker simply used a functioning lending market to park collateral and borrow against it, and the guardians and risk stewards moved to limit the damage. A long freeze has its own cost, because withdrawals by large suppliers raise utilization and borrow rates on the frozen reserves. The debate still running in the governance forum is structural: whether a lending protocol of this size should carry a flow limit so it cannot become an exit ramp the next time an exchange is breached.
Source: BlockchainReporter.