Decentralized lending protocol Aave has temporarily frozen all of its DAO-operated V3 and V4 markets as a precaution following a potential security incident involving wallets linked to a Binance exploiter. The move pauses new deposits and borrowing across the affected markets, while withdrawals and loan repayments remain available.

According to LlamaRisk, a risk service provider for the Aave protocol, a wallet associated with the exploiter deposited approximately $60 million in USDT — Tether's US dollar-pegged stablecoin — into Aave V3 Ethereum Core on October 29. Between 20:58 and 21:01 UTC, the same wallet borrowed 19,762 WETH, the wrapped ERC-20 form of Ether widely used in decentralized lending, valued at roughly $44.6 million. The transactions took place approximately 40 minutes before the first market freeze was enacted.

Precautionary Freeze, Smart Contracts Unaffected

Aave said the freeze was introduced as a precautionary measure while the situation is investigated. Importantly, the protocol stated that its smart contracts were unaffected, and it has not reported that the suspicious activity stemmed from any vulnerability in Aave's contracts.

Freeze Covers 292 Reserves Across Two Versions

The precautionary action spans a substantial portion of Aave's DAO-operated lending infrastructure, which operates across multiple blockchain networks. According to the reported figures, the freeze affects:

• 175 Aave V3 reserves across 16 blockchain networks
• 117 Aave V4 reserves across four blockchain networks

In total, 292 reserves across the two versions are now frozen. The measure prevents users from making new deposits or opening additional borrowing positions in the affected markets, including the Ethereum Core market where the suspicious activity took place. Existing users, however, can still withdraw their assets and repay outstanding loans.

That distinction matters, because a market freeze does not necessarily mean customer funds are inaccessible. Aave's response is instead designed to limit additional exposure to the suspicious activity while still allowing users to manage their existing positions. Reserve-level freezes are a standard risk-management control in decentralized lending, and the roughly 40-minute gap between the suspicious transactions and the first freeze illustrates how quickly such parameters can be applied once unusual activity is flagged.

According to LlamaRisk, the wallet linked to the Binance exploiter holds only one position on Aave, and that position remains over-collateralized, meaning the value of its deposited collateral exceeds the value of its outstanding loan. Over-collateralization is the core safety mechanic of DeFi lending markets: borrowers must post collateral worth more than the funds they draw, and positions whose collateral falls below required thresholds become eligible for liquidation.

Aave Freezes V3 and V4 Markets After Binance Exploiter Deposits $60M USDT and Borrows 19,762 WETH — Aave risk service provider LlamaRisk said one wallet linked to the Binance exploiter deposited about 60 million USDT into Aave V3 Ethereum Core and borrowed 19,762 WETH (worth… pic.twitter.com/rqvcSXknCS

— Wu Blockchain (@WuBlockchain) October 30, 2026

When Will Normal Operations Resume?

The freeze highlights how decentralized finance protocols can respond to unusual activity even when their underlying smart contracts remain secure. Lending platforms must consider risks that extend beyond smart contract vulnerabilities, including suspicious collateral movements and potential liquidation scenarios.

Aave said it intends to lift the restrictions as soon as possible. However, no confirmed reopening time has been provided. Developments to watch include whether the freeze is lifted across all 292 reserves or narrowed to specific markets, and whether LlamaRisk publishes further analysis of the flagged wallet. Users with existing positions should monitor official Aave communications for updates on market availability, and review their collateral and borrowing positions, particularly if market volatility increases.

For now, the precautionary freeze affects 292 reserves, while withdrawals and repayments remain operational. The episode underscores the importance of continuous risk monitoring in decentralized lending, where suspicious activity involving external wallets can trigger platform-wide protective measures.

Source: CoinoMedia