Decentralized finance lending protocol Aave has frozen hundreds of lending markets across multiple blockchain networks following the suspected $6.3 billion Binance hot-wallet exploit, seeking to prevent the attacker from using stolen assets as collateral to borrow additional funds.

In an October 30, 2026 governance forum update, Aave risk service provider LlamaRisk said it coordinated an emergency response with Aave Labs, TokenLogic, and Certora within 10 minutes of the first reports of the incident.

Hundreds of Reserves Frozen Across Aave V3 and V4

The emergency action resulted in 175 reserves being frozen across 16 networks on Aave V3 and another 117 reserves across four networks on Aave V4. The affected networks include Ethereum, Arbitrum, Avalanche, Base, BNB Chain, Optimism, Polygon and several others.

The freezes were executed by Aave's guardian multisig between 21:42 and 23:04 UTC on October 29, according to the forum update.

The Attacker Had Already Used Aave to Borrow $44.6 Million

LlamaRisk disclosed that a wallet belonging to the suspected Binance exploiter's cluster had interacted with Aave before the emergency restrictions took effect.

Between 20:58 and 21:01 UTC, the wallet deposited $60 million in Tether's USDT stablecoin into Aave V3's Ethereum Core market and borrowed 19,762 Wrapped Ether (WETH), worth approximately $44.6 million at the time.

The transaction effectively converted USDT — which its issuer can freeze — into Wrapped Ether, which does not carry the same centralized freezing mechanism. The borrowing occurred roughly 40 minutes before Aave executed its first market freeze.

LlamaRisk said no wallet associated with the attacker has interacted with the protocol since 21:01 UTC. The position currently holds approximately $59.9 million in USDT collateral against $43.8 million in outstanding debt, leaving it over-collateralized and subject to normal liquidation procedures.

According to Aave, the position is the attacker's only exposure to the protocol across all networks and versions, and it does not pose a risk to suppliers.

Why Aave Froze Markets Across Multiple Networks

Rather than restricting only the specific tokens stolen from Binance, Aave opted to freeze lending and borrowing activity across its markets. LlamaRisk explained that the attacker could exchange stolen assets for any token listed on Aave and subsequently use those assets as collateral to borrow other cryptocurrencies. Restricting only the stolen tokens would therefore have left alternative routes for the attacker to access liquidity through the lending protocol.

The team also chose an emergency freeze because Aave's guardian multisig can reverse the restrictions. Cutting supply and borrowing caps instead would have required a governance vote and approximately five days to restore.

The freeze prevents users, including the attacker, from opening new supply or borrowing positions. However, existing users can still withdraw assets and repay outstanding loans, and liquidations continue normally. Because users cannot add collateral to existing positions while the affected reserves remain frozen, repaying loans is the only way to improve their health factors during the restrictions.

Crypto Market Impact and Stablecoin Activity

Aave reported that its oracle feeds, which provide the external asset prices used to calculate collateral values and liquidations, continued operating normally throughout the incident.

As of 00:55 UTC on October 30, Bitcoin and Ether had each fallen approximately 4% since the Binance wallet drain.

State of the market following the #BinanceHack news.

— BitKE (@BitcoinKE) October 30, 2026

Several governance tokens held by the attacker recorded larger declines, with AAVE and Chainlink's LINK falling approximately 9%, Uniswap's UNI dropping 8% and Arbitrum's ARB declining 6%. Aave said the market freezes prevented the attacker from depositing these tokens into its lending markets, while existing positions backed by the assets remained healthy.

The protocol's GHO stablecoin also experienced a slight decline, slipping from approximately $0.998 to $0.997 as holders redeemed about 4.6 million GHO for USDT through its GHO Stability Module between 21:49 and 22:07 UTC.

Restrictions to Remain Until Binance Containment Improves

Aave said the affected markets will remain frozen until the attacker's funds stop moving and there is greater clarity on Binance's efforts to contain the incident. The protocol plans to coordinate with Aave Labs and other service providers on a staged reopening of the markets once conditions allow.

LlamaRisk warned that prolonged restrictions could also affect lending market liquidity. Because frozen reserves cannot receive new deposits, large withdrawals could increase utilization rates and borrowing costs for remaining users.

The response highlights how a security breach involving a centralized exchange can extend into decentralized finance, where stolen assets may be converted into collateral used to access liquidity or moved across multiple protocols.

Aave said it will continue tracking the attacker's wallets across Ethereum, Arbitrum, Optimism, and Avalanche while monitoring price feeds and potential liquidation risks.