Aave Froze Lending After a Large WETH Loan. What Could Users Still Do?
A wallet attributed to the Binance exploiter borrowed 19, 762 WETH against 60 million USDT on Aave V3 on October 29, 2026. Aave said its contracts were unaffected, but emergency restrictions extended far beyond that position, disrupting users who had nothing to do with it.
- Reported borrowing: 19, 762 WETH against 60 million USDT.
- During the freeze: New supply and borrowing were restricted across affected reserves; withdrawals, repayments and liquidations remained available.
- After reopening: Aave restored market activity, but nine assets still had zero borrowing power as collateral.
- Capacity cuts: Risk stewards removed about $3.83 billion in unused borrowing capacity, not losses or stolen funds.
LlamaRisk reported the wallet attribution and transaction details. They should not be mistaken for independent confirmation that Aave’s code was exploited. Aave said its contracts were unaffected. The distinction matters: a protocol can avoid a code exploit and still face liquidity pressure, while users bear the costs of emergency controls.
A large loan, not evidence of an Aave code exploit
According to LlamaRisk’s incident account, a wallet attributed to the Binance exploiter deposited 60 million USDT into Aave V3’s Ethereum Core market between 20:58 and 21:01 UTC on October 29. The wallet then borrowed 19, 762 WETH, worth approximately $44.6 million at the time.
LlamaRisk’s initial assessment put the collateral at $59.9 million and the debt at $43.8 million, describing the position as overcollateralised. The $43.8 million debt estimate differs from the approximately $44.6 million valuation at the time of the transaction. The available figures do not explain the difference, so neither should be treated as a correction of the other.
In collateralised lending, a borrower deposits one asset as security for a loan in another. If the collateral falls too far in value relative to the debt, the position may become eligible for liquidation. A position’s safety also depends on protocol parameters and oracle prices. A simple comparison of collateral and debt values does not establish its health factor.
Aave’s statement that its contracts were unaffected does not mean the incident had no consequences. The reported borrowing used Aave’s lending system, but that alone does not show the system’s code was broken. The wallet’s connection to the Binance breach is an attribution, not proof that the breach happened inside Aave.
What the freeze stopped, and what remained possible
The first reported freeze transaction followed at 21:42 UTC on October 29. Guardian transactions covering affected reserves continued through 23:04 UTC. LlamaRisk reported freezes on 175 V3 reserves and 117 V4 reserves. Those counts refer to reserves covered by the response. They are not a tally of distinct markets, or proof that every Aave reserve was affected.
During the freeze, new supply and borrowing were restricted in affected reserves. Withdrawals, repayments and liquidations remained available, and no market was paused. Users could not add fresh funds to frozen reserves or add collateral there while the restrictions were in place.
“Withdrawals remained available” does not mean every user could immediately withdraw any amount. A pool can pay out only the liquidity it has available, and borrowers still have to meet the protocol’s account and collateral rules. A freeze limits certain actions. It cannot conjure liquidity into a pool.
According to LlamaRisk, the response was precautionary. The wallet had borrowed before the first freeze transaction. Freezing new activity can limit further exposure while risk stewards assess a situation, but broad controls can also constrain users with no connection to the borrowing.
Why rates rose in some pools
Utilisation is the share of supplied liquidity that borrowers have taken out. When suppliers withdraw, available liquidity shrinks and utilisation can rise. Lending protocols typically raise borrowing rates as utilisation approaches a target, encouraging repayment and discouraging further borrowing.
In the affected reserves, the freeze prevented new deposits from replenishing liquidity while withdrawals reduced what remained. Borrowing was also restricted, so users could not keep increasing demand in those frozen reserves. LlamaRisk’s snapshot at 00:26 UTC showed V3 Core USDC at 97.8% utilisation and a 10.8% annualised borrowing rate. It reported USDT0 on Plasma at 100% utilisation and 14.5%, and USDC on Monad at 98.1% utilisation and 20.2%.
These were snapshots, not rates guaranteed to last a year. High utilisation can signal scarce liquidity, but it does not by itself establish insolvency or bad debt.
LlamaRisk proposed reducing the “Slope2” component of the interest-rate curve, the steeper portion used above a pool’s target utilisation. Its table showed selected USDC rates falling to 8% on Core and 8.8% on Monad under the proposed changes. A later update at 13:49 UTC said temporary rate adjustments had been executed and would be reviewed as conditions normalised.
The rate changes did not refund interest users had already accrued or paid.
Reopened markets did not mean every setting was restored
On October 30, 2026, Aave announced that its V3 and V4 markets were unfrozen. That ended the broad freeze, but some collateral settings remained restricted.
Nine assets remained restricted from supporting new borrowing: USDT, USDC, USDT0, POL, WAVAX, sAVAX, XAUt, PAXG and OP. On V3, the reported loan-to-value ratio, or LTV, for these assets was set to zero. On V4, the corresponding collateral factor was set to zero.
In practical terms, users could not use those assets to create new borrowing power under the specified settings. Zero LTV does not mean a token has no market value. It is also different from a liquidation threshold, which helps determine when an existing loan can be liquidated.
After reopening, users could still supply, withdraw, borrow and repay the listed assets, subject to normal market rules and available capacity. The remaining restriction applied to using them as collateral for new borrowing. It was not a blanket ban on interacting with the tokens.
Risk stewards also reduced unused borrowing capacity by about $3.7 billion on V3 and $130 million on V4, or approximately $3.83 billion combined. That figure represents borrowing headroom removed from protocol limits, not money lost or stolen. In the V3 Core market, the reported WETH borrowing cap fell from 2.4 million to 1.79 million tokens, the USDT cap from 3.09 billion to 2.56 billion, and the USDC cap from 2.7 billion to 2.27 billion.
The trade-off behind emergency controls
Emergency powers let a protocol restrict new lending quickly and restore activity as risks are assessed. They can also impose costs on unrelated suppliers and borrowers. In this incident, the response reached beyond the single reported wallet. Restrictions on deposits also meant rising rates could not attract fresh supply in the usual way.
Isolated lending markets offer another way to contain risk. In Morpho’s described design, each market pairs one collateral asset with one loan asset and uses its own liquidation LTV, oracle and interest-rate model. That separation can limit spillovers between markets, but it does not eliminate liquidity shortages or volatile rates within a market.
The choice is not simply between intervention and no risk. Different market structures distribute risk and control in different ways. Proposed automated supply- and borrowing-cap systems do not settle the question, either. An April proposal suggested a supply-cap updater with roughly 3% headroom and updates no more frequently than once an hour. Tyler Loewen’s 2024 Rivus Guard proposal described automated supply and borrow caps. The available information does not establish that either system was operating during this incident, or whether automation would have stopped this specific borrowing rather than limited its size or speed.
Key questions and answers
-
Was Aave’s code exploited?
Aave said its contracts were unaffected. The reported activity involved a wallet borrowing against deposited USDT, while the wallet’s attribution to the Binance breach remains a separate claim.
-
Could users withdraw during the freeze?
Yes. Withdrawals, repayments and liquidations remained available during the freeze, subject to pool liquidity and account constraints.
-
What changed when Aave reopened its markets?
Aave announced that V3 and V4 markets were unfrozen on October 30. Nine assets still had no borrowing power as collateral, so reopening did not restore every prior setting.
-
Did the $3.83 billion in cap reductions represent losses?
No. The figure represents unused borrowing capacity removed from V3 and V4 limits, not funds stolen, withdrawn or written off.
-
Would automated caps have prevented the borrowing?
That is unknown. The cited systems were proposals, not controls confirmed to have been operating during the incident. Their effect on this specific transaction has not been established.
