Aave, one of decentralized finance's largest lending protocols, has restored full lending market operations across its V3 and V4 protocols as of October 30, 2026, ending the precautionary closure it imposed after hackers breached Binance in an incident with reported losses of about $6.3 billion. All markets resumed full operation, with the exception of nine assets that remain subject to collateral restrictions.

In an update released on October 30, Aave confirmed that all markets had resumed full operations, adding that the underlying contracts were unaffected and all positions remained fully secured.

Nine assets can be supplied but no longer back loans

The restricted assets are USDT, USDC, USDT0, POL, WAVAX, sAVAX, XAUT, PAXG and OP, along with their wrapped and bridged forms. In a statement on October 30, risk service provider LlamaRisk reported that the assets carry a zero loan-to-value ratio in Aave V3 and a zero collateral factor in V4.

The restrictions do not prevent users from transacting with the affected assets. Users can deposit, withdraw, borrow and repay funds exactly as before; the measures only stop these assets from being used as collateral for new loans.

Current V3 positions will not be impacted: their liquidation thresholds and health scores will remain the same. On V4, existing collateral parameters will continue to be valid until a borrower either borrows additional funds, withdraws the collateral, or alters the collateral status of an asset.

How stolen USDT became a $44.6 million WETH loan

The hackers had made use of Aave before the freeze took effect. Between 20:58 and 21:01 UTC on October 29, a wallet associated with the attackers deposited 60 million USDT into Aave V3 on Ethereum Core, the protocol's primary Ethereum market, and borrowed approximately 19,762 WETH (wrapped Ether), which was worth around $44.6 million at the time.

At 21:42 UTC, Aave announced a freeze on its lending markets. New deposits and borrowing activity were halted, while withdrawals, repayments and liquidations remained in place.

A report published by LlamaRisk on October 30 indicated that the assets in that position were worth a total of $59.9 million, while the outstanding debt stood at $43.8 million. The position therefore remained overcollateralized, and LlamaRisk added that none of Aave's suppliers were at any risk.

Why reopening squeezed liquidity

The freeze barred new borrowing but also put pressure on existing borrowers. Suppliers could withdraw their funds, while new deposits remained blocked. As liquidity fell, utilization — the share of supplied funds actually out on loan — in major stablecoin pools climbed to between 92% and 100%, according to LlamaRisk's October 30 analysis.

Under normal conditions, higher borrowing rates help attract fresh deposits, but frozen reserves could not accept them. Instead, rising interest costs added to borrowers' debt. To ease the pressure, LlamaRisk implemented temporary Slope2 interest-rate reductions on Aave V3 and Aave V4, trimming the steep end of the rate curve that governs borrowing costs when pools run near full utilization.

The reopening also carried a new risk: billions of dollars in unused borrowing capacity could become available at once. A new risk adjustment tightened borrowing limits, and per LlamaRisk's October 30 update, the changes eliminated $3.7 billion of unused capacity on V3 and $130 million on V4.

With those safeguards in place, Aave's guardians proceeded to reopen the markets in four waves, and most assets regained their ability to serve as collateral.

What it means for crypto credit

The episode highlights an important distinction: Binance was the platform that was breached, not Aave, yet the attacker was able to route stolen funds through Aave's lending markets, forcing the protocol to take precautionary measures. The scale of the theft made the situation particularly serious. Elliptic's October 30 analysis put the losses at $6.43 billion — more than four times the $1.46 billion stolen from Bybit in 2025.

Binance, meanwhile, has pledged to cover losses using its SAFU reserve — an emergency fund the exchange maintains to protect user assets in a crisis — and corporate funds. In an October 30 statement, the exchange said approximately $3 billion had been frozen on-chain, although freezing stolen assets does not necessarily mean they have been recovered.

The disruption also spread to trading desks. Reuters reported on October 30 that GSR saw Bitcoin spreads widen to five times their normal level, while Ether spreads reached 2.5 times normal.

Aave's reopening returns its lending business to normal across most assets, though a slimmer set of guardrails remains in place: nine assets at zero loan-to-value, tightened borrowing caps on V3 and V4, and interest-rate relief labeled temporary in the proposal that introduced it. The episode also demonstrates how liquidity and borrowing across decentralized markets can be affected when a security breach occurs at a single platform.

Source: Cryptopolitan