The Aave lending protocol has moved all V3 and V4 markets under DAO control into freeze mode after a wallet linked to the Binance hacker borrowed 19,762 WETH. Users retain the ability to withdraw assets and repay loans, but new deposits and borrows are temporarily unavailable.
For depositors, this means funds are not locked, but earning income on new investments is not possible for now. The smart contracts were not affected, and the restrictions are promised to be lifted as soon as possible.
A $44.6 million loan in three minutes
Risk assessment analysts at LlamaRisk determined that one of the Binance hacker's wallets deposited about 60 million USDT into the Aave V3 Ethereum Core market. Using this collateral, the attacker borrowed 19,762 WETH (a tokenized version of ETH for DeFi applications) worth approximately $44.6 million.
All transactions took place from 23:58 to 00:01 Moscow time on the night of October 30 — roughly 40 minutes before the first freeze. The value of the collateral still exceeds the debt amount, and the attacker has no other positions on Aave.
The restrictions affected 175 asset pools across 16 blockchains on V3 and 117 pools across four networks on V4. The freeze is positioned as a precautionary measure amid a possible incident involving wallets linked to Binance.
The Binance hack and pressure on DeFi
The freeze on Aave is a continuation of the attack on Binance: the exchange estimated the damage at approximately $6.3 billion, and on-chain investigator ZachXBT linked the hack to North Korean hackers. The attacker continues to sell off tokens through decentralized exchanges, so the risks have extended far beyond the platform itself.
This is not Aave's first risk-reduction measure: in July, the protocol disabled 75 assets and fully exited six networks. At that time, according to founder Stani Kulechov, the changes affected $98.1 million in deposits and $15.6 million in loans, and the current restrictions are temporary but cover nearly 300 pools.
Such incidents could become an argument for European regulators, who are already discussing stricter rules for decentralized finance. In early October, Kulechov accused the ECB and EBA of trying to cut Europeans off from DeFi: the EBA proposed examining the regulation of crypto lending, including clients' access to decentralized protocols.
Cryptalist analysis: The freezing of nearly 300 pools demonstrates that the largest DeFi protocols are increasingly acting as risk managers rather than passive infrastructure. Keeping withdrawals open reduces the likelihood of panic and a bank run, but the precedent itself strengthens regulators' arguments in favor of stricter oversight of lending protocols. For the market, this is a signal: the link between CeFi hacks and DeFi liquidity is becoming a systemic risk that will be factored into assessments of the sector's resilience.