Aave Reopens V3 and V4 Markets After Binance Hack, Keeps

Nine Crypto Assets at Zero LTV

Introduction

Decentralized lending protocol Aave has reopened its V3 and V4 markets following the major security incident involving Binance, restoring lending activity while maintaining restrictions on nine crypto assets.

The precautionary freeze was introduced after attackers reportedly exploited Binance-linked hot wallets and moved billions of dollars in digital assets. Although Aave itself was not compromised, the attacker used its Ethereum lending market to deposit $60 million in USDT and borrow 19,762 Wrapped Ether (WETH), worth approximately $44.6 million at the time.

Aave has now moved from a broad market suspension to targeted collateral restrictions. Nine assets, including USDT, USDC and USDT0, remain at zero loan-to-value (LTV), preventing them from supporting new borrowing positions.

The reopening restores access across most of Aave's lending markets, but the restrictions highlight how security incidents at centralized exchanges can create liquidity and risk-management challenges for decentralized finance platforms.

Key Highlights

• Aave reopened its V3 and V4 markets on October 30, following the precautionary freeze.

• Nine assets remain at zero LTV on V3 and zero collateral factor on V4.

• The restricted assets include USDT, USDC, USDT0, POL, WAVAX, sAVAX, XAUT, PAXG and OP.

• An attacker-linked wallet deposited $60 million in USDT and borrowed 19,762 WETH from Aave V3.

• LlamaRisk valued the collateral at approximately $59.9 million against $43.8 million in debt.

• Aave said its contracts were unaffected and existing positions remained adequately collateralized.

• Risk managers reduced borrowing capacity by approximately $3.7 billion on V3 and $130 million on V4.

Aave Restores Lending Operations After Emergency Freeze

Aave's decision to freeze markets followed reports of a security breach involving Binance hot wallets on October 29.

According to risk provider LlamaRisk, the attacker moved assets across several blockchain networks, creating concerns that stolen tokens could be converted into other listed assets and used as collateral to obtain additional loans.

Aave's risk team coordinated with Aave Labs, TokenLogic and Certora to assess the situation. The decision was to freeze markets across multiple networks rather than restrict only the assets initially associated with the attacker.

The freeze covered 175 reserves on Aave V3 across 16 networks and 117 reserves on Aave V4 across four networks. The Horizon real-world asset market remained open because its permissioned collateral could not be used by the attacker.

During the suspension, users could still withdraw funds, repay loans and participate in liquidations. However, new deposits and borrowing were paused on the affected reserves.

Aave subsequently confirmed that its markets had reopened, with selected assets remaining under additional collateral restrictions.

Nine Assets Remain at Zero LTV

The most important condition attached to the reopening is the continued restriction on nine digital assets.

The assets identified by LlamaRisk are:

Asset	Ticker
Tether	USDT
USD Coin	USDC
Tether USD (bridged)	USDT0
Polygon Ecosystem Token	POL
Wrapped Avalanche	WAVAX
Benqi Staked AVAX	sAVAX
Tether Gold	XAUT
PAX Gold	PAXG
Optimism	OP

The restrictions also cover relevant bridged and wrapped versions of these assets.

A zero LTV setting means that an asset cannot contribute collateral value toward a new borrowing position. On Aave V3, the affected assets remain at zero LTV, while the corresponding V4 settings use a zero collateral factor.

Importantly, this does not mean that users have completely lost access to these tokens within Aave. The assets can still be supplied, withdrawn, borrowed and repaid under the applicable market rules. The restriction specifically prevents them from supporting new borrowing capacity as collateral.

Existing V3 positions retain their liquidation thresholds and health factors, according to the published risk update. V4 positions remain subject to their existing collateral parameters until users make certain changes, such as borrowing additional funds or modifying collateral.

The restrictions are precautionary measures, and their duration will depend on further risk assessments.

How the Attacker Used Aave Before the Freeze

The incident also exposed a direct connection between the Binance breach and Aave's lending markets.

LlamaRisk reported that, between 20:58 and 21:01 UTC on October 29, a wallet associated with the attacker deposited approximately $60 million in USDT into Aave V3's Ethereum Core market.

The wallet then borrowed approximately 19,762 WETH, valued at around $44.6 million at the time.

The position was still overcollateralized in LlamaRisk's October 30 assessment:

• Collateral: Approximately $59.9 million in USDT.

• Outstanding debt: Approximately $43.8 million in WETH.

• Borrowed asset: 19,762 WETH.

• Position status: Overcollateralized and subject to normal liquidation procedures.

LlamaRisk stated that this position did not put Aave suppliers at risk. It also reported that no attacker-linked wallet had interacted with Aave after 21:01 UTC on October 29.

Aave's freeze was therefore a preventive response to the possibility of further activity, rather than confirmation that the lending protocol itself had been exploited.

Liquidity Pressure and Borrowing Capacity Adjustments

Although the emergency freeze helped limit potential attacker activity, it also created liquidity challenges for ordinary users.

During the suspension, suppliers could continue withdrawing funds while new deposits into frozen reserves were blocked. This reduced available liquidity and pushed utilization in major stablecoin pools to approximately 92%–100%, according to LlamaRisk.

High utilization can increase borrowing costs and make it harder for users to access available liquidity. Because frozen reserves could not accept new supply, the usual market mechanism of attracting additional deposits through higher interest rates was constrained.

Aave's risk managers adjusted interest-rate parameters to reduce pressure on borrowers. They also tightened borrowing limits before reopening the markets.

According to LlamaRisk's updates, the changes removed approximately:

• $3.7 billion in unused borrowing capacity on Aave V3.

• $130 million in unused borrowing capacity on Aave V4.

The revised borrowing caps were designed to limit the amount of new leverage that could become available immediately after the reopening.

These adjustments show that restoring market access did not mean returning every lending parameter to its previous level.

What the Binance Incident Means for the Wider DeFi Market

The episode illustrates how interconnected centralized exchanges and decentralized lending protocols have become.

The reported breach originated from Binance's infrastructure, but the movement of stolen assets created risks for other platforms where those assets could be deposited, exchanged or used as collateral.

Aave's response demonstrates one way DeFi protocols can limit potential exposure: temporarily freezing markets, monitoring attacker-linked wallets and applying asset-specific collateral restrictions.

However, these measures also involve trade-offs. Broad freezes can affect legitimate borrowers and suppliers, while reopening too quickly could restore borrowing capacity before the underlying security situation is fully understood.

The incident also raises wider questions about how lending protocols should respond when assets originating from an external exploit enter their markets.

For DeFi users, the key issue is not only whether a protocol's smart contracts have been compromised. It is also whether external events can affect collateral quality, liquidity availability, borrowing costs and the ability to exit positions.

What Happens Next?

Several developments will determine how quickly Aave can return to its normal risk settings.

1. Review of the nine restricted assets

Market participants will be watching for updates from Aave's risk providers on when the zero-LTV and zero-collateral-factor restrictions could be adjusted.

2. Monitoring attacker-linked wallets

LlamaRisk has been tracking wallets associated with the exploit and monitoring activity across relevant networks. Further movement of stolen assets could influence risk decisions.

3. Liquidity and utilization levels

Stablecoin pool utilization, borrowing rates and available liquidity will remain important indicators as users return to the markets.

4. Binance's incident response

Further information about the breach, asset recovery and exchange operations could affect how DeFi protocols assess exposure to the incident.

5. Borrowing-capacity reviews

The reduced borrowing limits may remain important safeguards while risk teams assess whether market conditions have stabilized.

Final Takeaway

Aave's reopening marks an important step toward restoring normal activity after the Binance security incident, but the nine zero-LTV restrictions show that the protocol is not treating the situation as fully resolved.

The attacker-linked borrowing activity demonstrated how assets from a centralized exchange breach can enter decentralized lending markets and create risks beyond the original platform.

Aave's contracts were not reported compromised, and LlamaRisk described the identified attacker position as overcollateralized. Nevertheless, the episode highlights the importance of liquidity management, collateral controls and coordinated security responses across the crypto ecosystem.

For DeFi participants, the next phase will depend on how effectively Aave balances market accessibility with the need to maintain safeguards against further risk.

Informational Disclaimer

This article is published by Coinccino for informational and educational purposes only. It does not constitute financial, investment, trading, or legal advice. Cryptocurrency markets involve significant risks, including volatility, liquidity constraints, smart-contract vulnerabilities and security incidents. Coinccino does not provide buy or sell signals or guarantee investment outcomes. Readers should verify information through official sources and conduct independent research before making financial decisions.