Aave Restores All V3 and V4 Markets After Binance Hack, Holding Nine Assets at Zero LTV
Key Takeaways
- •Aave froze all V3 and V4 markets on October 29, 2026, after the Binance exploiter deposited 60 million USDT and borrowed roughly $44.6 million in WETH, but its contracts were never compromised and the position remained overcollateralized.
- •Nine assets — USDT, USDC, USDT0, POL, WAVAX, sAVAX, XAUT, PAXG, and OP — remain at zero loan-to-value across all markets, so they cannot be pledged as collateral for new borrows even though deposits, withdrawals, and repayments continue normally.
- •LlamaRisk removed approximately $3.7 billion in unused borrow capacity from Aave V3 and $130 million from V4 through cap reductions, with restorations possible via the Risk Steward process after a 36-hour cooldown.
- •The underlying incident was the record $6.3 billion Binance breach, attributed by TRM Labs to North Korea's TraderTraitor group, which exploited EIP-7702 delegation through a compromised DevOps engineer's laptop to exceed the $1.46 billion Bybit hack by more than four times.
- •AAVE gained 4.88% to $132.39 on October 30 even as BTC fell about 4.9% and BNB dropped roughly 8%, a divergence attributed to user confidence in Aave's transparent, staged response.

Aave has reopened all of its V3 and V4 markets following a precautionary freeze triggered by the Binance hack, but nine assets — including USDT, USDC, and OP — will remain at zero loan-to-value (LTV) until further notice, meaning they cannot be pledged as collateral for new borrows.
All markets were frozen at approximately 21:42 UTC on October 29, 2026, after the Binance exploiter deposited 60 million USDT into Aave V3 Ethereum Core and borrowed approximately 19,762 WETH, worth roughly $44.6 million. Aave’s contracts were never compromised during the event, and the exploiter’s position held $59.9 million in assets against $43.8 million in debt, remaining overcollateralized throughout.
The underlying incident was the $6.3 billion breach of Binance, attributed with high confidence by TRM Labs to North Korea’s TraderTraitor group. The attackers exploited EIP-7702 delegation to bypass hot wallet approval controls via a compromised DevOps engineer’s laptop, making it the largest crypto theft on record — more than four times the scale of the $1.46 billion Bybit hack in 2025.
What Changed When Aave Reopened Its Markets
All Aave V3 and V4 markets were fully unfrozen on October 30, 2026, in four staged waves. During the freeze period, withdrawals, repayments, and liquidations continued normally; only new supply and borrow actions were paused. The staged reopening allowed Aave’s risk team to monitor conditions before restoring full market activity.
Alongside the reopening, risk manager LlamaRisk removed approximately $3.7 billion in unused borrow capacity from Aave V3 and $130 million from Aave V4 through targeted cap reductions, detailed in its post to the Aave Governance Forum. The rationale, per LlamaRisk: “A reopened market with this headroom would let a single actor build a large position in the first blocks after the unfreeze.” Caps can be restored through the standard Risk Steward process after a 36-hour cooldown.
Open Markets vs. Eligible Collateral: A Key Distinction
In Aave’s architecture, a market being “open” and an asset being usable as collateral are two separate things. Users can still deposit, withdraw, borrow, and repay any of the nine restricted assets normally. What they cannot do is pledge those assets to back new loans. Zero LTV simply means the protocol assigns no borrowing power to that collateral position.
Why Nine Assets Remain at Zero LTV
Aave officially confirmed in its announcement that USDT, USDC, USDT0, POL, WAVAX, sAVAX, XAUT, PAXG, and OP “will temporarily remain at an LTV of 0 so they can’t be used as collateral for new borrows.” The restriction covers all wrapped and bridged versions of these assets across every market and V3 E-Mode configurations.
The selection of these nine assets is connected to how the Binance exploiter interacted with the protocol. Stablecoins like USDT and USDC were the assets deposited and moved during the incident, while assets like POL, WAVAX, and sAVAX carry cross-chain exposure that introduces additional risk during a period when major stablecoin issuers were actively freezing exploiter wallets. Tether froze approximately $1.567 billion in USDT and Circle froze over $800 million in USDC from the exploiter’s addresses — actions that could affect collateral valuations rapidly.
Supplying vs. Borrowing Against an Asset
The zero-LTV designation is a surgical tool, not a blanket ban. A supplier who already holds USDC in Aave as collateral from before the restriction is not immediately liquidated; their existing collateral factor is unaffected. Only new positions opened after the change cannot use these nine assets to generate borrowing power.
LlamaRisk is monitoring the exploiter’s wallets and Aave’s price feeds while evaluating conditions for restoring collateral borrowing power, though specific timelines had not been published as of October 30, 2026.
During the freeze window, stablecoin pool utilization on Aave climbed to 92 to 100 percent — a systemic stress indicator showing how a CeFi exploit can propagate into DeFi liquidity constraints within hours. Multiple other protocols, including Compound, Moonwell, Kamino, BENQI, and Venus, also paused activity in the same window.
AAVE Token Bucked the Broader Selloff
Despite broader market fear following the incident, with BTC falling approximately 4.9 percent and BNB dropping roughly 8 percent on October 30, AAVE moved in the opposite direction. The token traded at $132.39, a 4.88 percent 24-hour gain, with a market capitalization of approximately $2.04 billion, per CoinGecko. The divergence reflected user confidence in the protocol’s transparent, staged response rather than a broader market rotation.
The broader crypto Fear and Greed Index sat at 30, within the “Fear” zone, as of October 30, according to alternative.me. Binance separately set aside $6.34 billion in company funds to cover hack losses and is cooperating with the FBI and Secret Service on asset recovery, while submitting weekly fund reports to Abu Dhabi’s FSRA.
What Aave Users Should Check Next
Users holding any of the nine restricted assets as collateral should verify their current health factor through the official Aave interface. Existing collateral positions are not being liquidated, but adding more of these assets to a position will not increase borrowing capacity until the zero-LTV setting is lifted.
Current Collateral Settings and Borrowing Capacity
For users on Aave V3, the restriction applies across all networks and E-Mode pools. For Aave V4, the equivalent zero collateral factor applies. Anyone looking to open new leveraged positions using stablecoins or the other seven restricted assets should wait for LlamaRisk’s formal review and official parameter updates via the Aave Governance Forum before proceeding.
The Aave V4 expansion, which launched on Avalanche as the protocol’s first move beyond Ethereum, is also subject to the same cap reductions on draw capacity. Users on that deployment face the same $130 million reduction in available borrow headroom applied across the V4 markets. Borrow cap restorations will occur through the standard Risk Steward process, with each change subject to a 36-hour cooldown between adjustments.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.