Aave Takes Action: 292 Reserves Frozen After Binance Security Breach

Response to Security Breach at Binance

In a substantial response to a recent security breach at Binance, the decentralized finance (DeFi) platform Aave has implemented a freeze on 292 reserves across its V3 and V4 lending markets. The security incident unfolded on October 29, 2026, at 3:24 p.m. EST, when unknown assailants siphoned off a staggering 195,000 ETH alongside millions in alternative cryptocurrencies from Binance's hot wallets. This led Aave to take swift action to protect its liquidity across 16 different blockchain networks.

Details of the Attack

Initially, the attack saw the hacker execute a significant transaction involving 167,464 ETH and 63 other tokens, directing them from a Binance Ethereum-based hot wallet to an unspecified destination. Almost immediately thereafter, they withdrew an additional 28,006 ETH from another Binance wallet, together with other digital assets through networks like Arbitrum, Optimism, and Avalanche. This sequence of transactions extended over two hours, indicating the ongoing risk posed by the breach. Security teams noted that by 5:04 p.m. EST, the attackers had transferred 444,537 AVAX on Avalanche, further suggesting that vulnerabilities remained active.

Asset Diversification and Response

As the breach escalated, the perpetrators began to diversify their assets among over 20 wallet addresses, liquidating funds on decentralized exchanges by converting tokens, including Uniswap (UNI), Chainlink (LINK), and Aave (AAVE), into ether. During a brief window between 3:58 p.m. and 4:01 p.m. EST, prior to Aave's protective measures, an attacker-linked wallet proceeded to deposit $60 million in Tether (USDT) into Aave's V3 Ethereum Core and borrowed approximately $44.6 million in wrapped ether (WETH), maintaining an overcollateralized position that did not pose a significant insolvency threat to Aave's liquidity providers.

Emergency Measures and Current Status

Aave Labs, supported by security professionals from partners like Tokenlogic and Certora, mobilized quickly, forming a specialized emergency response unit ten minutes into the incident to manage the crisis effectively. Rather than selectively halting affected reserves, protocol guardians opted for a global suspension to prevent the conversion of stolen assets into funds accessible through other pools. Consequently, from 4:42 p.m. to 6:04 p.m. EST, a coordinated freeze was enacted on 175 reserves across Aave V3 and 117 reserves on Aave V4, affecting networks such as Ethereum and Avalanche, without disrupting the permissioned Horizon real-world asset (RWA) market.

Under the current conditions, users are permitted to repay debts and withdraw their collateral; however, new deposit and borrowing functionalities have been suspended pending further updates. In the wake of this incident, Binance disclosed that the breach was more intricate than initially assessed, revealing multiple points of entry rather than solely the suspected compromise of an employee laptop. The exchange has now committed to cooperating with law enforcement to trace the stolen funds and recover assets, successfully freezing approximately $3 billion in compromised or suspicious accounts.

Market Reactions

As the aftermath of the hack unfolded, cryptocurrency values were quick to respond, with Bitcoin dropping to $76,320 and Ether sliding to $2,170. The tokens that the attackers sold experienced steeper declines, particularly AAVE, which saw a 9% drop, alongside others like UNI and LINK. Although most fiat-backed stablecoins retained their value, Aave's GHO stablecoin saw a brief dip to $0.997 as users converted over 4.6 million GHO back to USDT via its stability mechanism.

Future Considerations

Protocol engineers from Aave have indicated that the current market freeze will persist until further developments emerge regarding the containment of the attacker's actions and a stabilization of their activity. A phased approach to lift these restrictions will be considered once conditions permit. Binance reassured customers that all accrued losses would be compensated through its Secure Asset Fund for Users (SAFU) as well as corporate funds, emphasizing its commitment to customer safety and security throughout this enduring crisis.