# Binance Hot Wallet Exploit: Aave's Response **URL:** \ **Category:** Risk\ **Created:** [October 30, 2026, 12:59am UTC](https://governance.aave.com/t/binance-hot-wallet-exploit-aaves-response/25954 "2026-10-30T00:59:32Z")\ **Posts on this page:** 8\ **Page:** 2
**Author:** ![0kage.eth](https://avatars.discourse-cdn.com/v4/letter/0/df788c/32.png) [@0kage.eth](https://governance.aave.com/u/0kage.eth)\ **Post date:** [November 2, 2026, 9:18am UTC](https://governance.aave.com/t/binance-hot-wallet-exploit-aaves-response/25954/22 "2026-11-02T09:18:22Z")
@LlamaRisk could you clarify **what residual risk justified the broad freeze after Tether and Circle had already blacklisted the aggregation wallet of binance attacker, and why the existing supply/borrow limits were insufficient to contain it?** The onchain mainnet sequence I am looking at is below. All times are UTC on 29 October 2026; each event links to its transaction. Before the first Aave deposit at 20:57:59, the traced routes had sold approximately **274 M USDT for ETH/WETH.** Here is a timeline I generated by observing onchain txns (links at the end of the post). ![Transaction Timeline Infographic Table](https://europe1.discourse-cdn.com/flex013/uploads/aave/original/2X/b/bc2778fb7b663d937508748dae03efb2fce3dc25.jpeg) Above transactions I feel are evidence that obtaining ETH using freezable USDT was an early priority for the attacker. **Avoiding issuer freezes is probably what the attacker was trying to do first before dumping other assets.** First they went for swaps, and when slippage became significant where borrowing made better sense, they started targeting Aave with the intent of dumping freezable assets ASAP. The first V3 Core batch followed the aggregation-wallet Tether and Circle blacklists by **45m48s and 42m24s** , respectively. I understand the rationale already given, ie. alternative collateral routes remained possible, and reversing cap cuts would have taken longer than reversing a freeze. Risk stewards action post also quantifies the later removal of about $3.7B of unused V3 borrow capacity and $130M on V4. Those are useful answers about coverage and controls. My narrower question is **how much of the remaining capacity the attacker could actually access after issuer freeze, and what outcome made that exposure unacceptable?**. Unused protocol capacity is not necessarily executable attacker borrowing. If possible, could you expand on three below points about risk management decisions in the war room? While the actions are clear, what is not clear is what data led to those actions.. 1. **Residual capacity:** After accounting for issuer-frozen balances, what usable collateral did you estimate remained at the initial freeze decision and execution times? How much additional borrowing could it support within the applicable collateral parameters, caps and available liquidity? Risk Steward Actions quantifies unused capacity removed, I am asking about the portion accessible to the attacker. 2. **Risk beyond existing controls:** For the residual assets unaffected by the issuer blacklists, why was allowing markets to continue operating under their existing supply caps, borrow caps and collateral parameters considered unsafe? Did the team identify an exposure those controls could not adequately contain, or was the broad freeze a precaution because that exposure could not be assessed quickly enough? 3. **Timing and scope:** When were the issuer blacklists incorporated into the assessment? What made blocking new supply necessary alongside restricting borrowing, and what subsequently enabled reopening: better information about remaining funds, implementation of tighter controls, or both? Transaction links | Time | Block | Event | |—|—:|—| | 20:36:11 | 26,300,829 | [Attacker route swaps 100M USDT for ETH]([Ethereum Transaction Hash: 0x4fa182626c... | Etherscan](https://etherscan.io/tx/0x4fa182626c85ca0cdc18ba736930bdbdfbcf5d201d373913317df6ec58d23d61)) | | 20:57:59 | 26,300,936 | [First Aave deposit: 10M USDT]([Ethereum Transaction Hash: 0x420e740153... | Etherscan](https://etherscan.io/tx/0x420e74015336a44f3056c00bf5a1313889a7f6ed30a053ad59832d4a4a1f14eb)) | | 20:59:11 | 26,300,942 | [First Aave borrow: 3,271.43 WETH]([Ethereum Transaction Hash: 0x01b3406c2b... | Etherscan](https://etherscan.io/tx/0x01b3406c2bcf1b9206c38dce48a9a98f9fb988438cc971f374ea5ed982e2d870)) | | 21:00:11 | 26,300,947 | [Second Aave deposit: 50M USDT]([Ethereum Transaction Hash: 0x65bd82f199... | Etherscan](https://etherscan.io/tx/0x65bd82f19985a569ef87b3926dd5f2247ba7bd06640141060f1b2d9ddedec3f6)) | | 21:00:59 | 26,300,951 | [Second Aave borrow: 16,490.99 WETH]([Ethereum Transaction Hash: 0xa85ad4807b... | Etherscan](https://etherscan.io/tx/0xa85ad4807b33ad63ba2b2ffbac63d913285eefe44d7e56495a4856e6374d9d5f)) | | 21:01:35 | 26,300,954 | [Tether blacklists aggregation wallet]([Ethereum Transaction Hash: 0x7baba48207... | Etherscan](https://etherscan.io/tx/0x7baba482077843514d9c72bac0110ba0916b0814288a72917e2c3bb27a9d8659)) | | 21:04:59 | 26,300,971 | [Circle blacklists aggregation wallet]([Ethereum Transaction Hash: 0xc954c86f11... | Etherscan](https://etherscan.io/tx/0xc954c86f118e8e410e6a3eb9e3b38ff4a95fbdae9d2d58e13166afb7a1f4fc5f)) | | 21:42:11 | 26,301,157 | [Aave V4 Ethereum Guardian freeze execution]([Ethereum Transaction Hash: 0x2d144463f6... | Etherscan](https://etherscan.io/tx/0x2d144463f6083fd01388e11b1c2d746fa4115b79967ac9cb19a355461e357c0a)) | | 21:47:23 | 26,301,183 | [First Aave V3 Core freeze batch]([Ethereum Transaction Hash: 0x405bee93de... | Etherscan](https://etherscan.io/tx/0x405bee93def8c9114e28a5338d03946b9d1c8e4dd6ff318973ce71723c0038bd)) | [100M USDT through 1inch]([Ethereum Transaction Hash: 0x4fa182626c... | Etherscan](https://etherscan.io/tx/0x4fa182626c85ca0cdc18ba736930bdbdfbcf5d201d373913317df6ec58d23d61)), followed by [50M USDT]([Ethereum Transaction Hash: 0xfa949551ee... | Etherscan](https://etherscan.io/tx/0xfa949551eeec164133714f7658e232bf7eb8140a67d8f5edb95ea41b31b93a72)), [75M USDT]([Ethereum Transaction Hash: 0xa861a556b7... | Etherscan](https://etherscan.io/tx/0xa861a556b73df4e084aca07663d63b26eec33136ed7328712a7418361d856f36)), [15M USDT]([Ethereum Transaction Hash: 0xe5ccc3a8b3... | Etherscan](https://etherscan.io/tx/0xe5ccc3a8b32f7c52683390fa75f57cec53394421bd05132400806533e661843a)) and [5M]([https://etherscan.io/tx/0x7b0ad8b5814a048086dab1236284e677e430cac142c84ab6bbbc985da1f282e6](https://etherscan.io/tx/0x7b0ad8b5814a048086dab1236284e677e430cac142c84ab6bbbc985da1f282e6)) through 0x routes. The cluster also [supplied 28.6M USDT to Compound to borrow WETH at 20:49:35]([Ethereum Transaction Hash: 0x3fd5ec345e... | Etherscan](https://etherscan.io/tx/0x3fd5ec345eaf60faca94c652f5ac5c0dca77b4ef3c355fb12cb8f5108464a0b6)). Aave then provided another route: 60M USDT collateral against approximately 19,762.41 WETH borrowed. Core batches executed at [21:48:59]( [Ethereum Transaction Hash: 0x67dce7f17a... | Etherscan](https://etherscan.io/tx/0x67dce7f17a075e96cce4f9f8bfe48b0efe2a9657da8d2c049552d908d4611730) ) and [21:49:59]([Ethereum Transaction Hash: 0xe0ba846606... | Etherscan](https://etherscan.io/tx/0xe0ba846606758df7fe6ccd42714e2e07fe1fd7eddcb43df8baa1ae8bde2ca1ba)). ---
**Author:** ![DisplayedUsername](https://avatars.discourse-cdn.com/v4/letter/d/9e8a1a/32.png) [@DisplayedUsername](https://governance.aave.com/u/DisplayedUsername)\ **Post date:** [November 2, 2026, 2:03pm UTC](https://governance.aave.com/t/binance-hot-wallet-exploit-aaves-response/25954/23 "2026-11-02T14:03:25Z")
Hello, Making a post here as suggested by the support. The current precaution measures with stablecoin zero LTV on Aave v4 have caused a bad situation for me, where I’m unable to unwind my position with USDC collateral and WBTC loan, with borrowed elsewhere against WBTC funds added back to the USDC collateral on Aave. The current restrictions don’t allow me to withdraw any USDC, which is needed for keeping the health factor safe, repaying the loan and releasing the borrowed WBTC from the other position. In case the LTV for USDC (and other keep-list assets) on Aave v4 is not going to be restored to its previous value within a day or two, I’m requesting a change where the partial collateral withdrawal from position would not force the position’s LTV to be updated to 0 - which is the same behavior as currently for partial loan repayment. Hoping for this to be sorted out soon. ---
**Author:** ![iceman12](https://avatars.discourse-cdn.com/v4/letter/i/41988e/32.png) [@iceman12](https://governance.aave.com/u/iceman12)\ **Post date:** [November 2, 2026, 6:42pm UTC](https://governance.aave.com/t/binance-hot-wallet-exploit-aaves-response/25954/24 "2026-11-02T18:42:18Z")
I think the collateral factors have been restored? Is everything back to normal with AAVE? ---
**Author:** ![LlamaRisk](https://dub1.discourse-cdn.com/flex013/user_avatar/governance.aave.com/llamarisk/32/12865_2.png) [@LlamaRisk](https://governance.aave.com/u/LlamaRisk)\ **Post date:** [November 2, 2026, 8:45pm UTC](https://governance.aave.com/t/binance-hot-wallet-exploit-aaves-response/25954/25 "2026-11-02T20:45:01Z")
_Update, 18:21 UTC, 2 November 2026._ ## LTV restored for the non-stablecoin keep-list assets Binance has resumed withdrawals, and the surge in outflows that followed has stabilised. Together with Aave Labs and the other Aave service providers, we agreed to restore LTV for the keep-list assets other than stablecoins. The guardians executed the Aave V3 transactions at 15:55 UTC and the Aave V4 transactions between 16:22 and 16:24 UTC today. Every restored reserve returns to the configuration it had before the freeze. On Aave V3, LTV is restored for the following reserves: | Network | Asset | Restored | | --- | --- | --- | | Polygon | WPOL | 68% base LTV and the MATIC correlated E-Mode | | Avalanche | WAVAX | 68% base LTV and the AVAX correlated E-Mode | | Avalanche | sAVAX | 50% base LTV and the AVAX correlated E-Mode | | Ethereum Core | XAUt | XAUt / USDC, USDT, GHO E-Mode | | Plasma | XAUt0 | XAUt / USDT E-Mode | XAUt on Ethereum Core and XAUt0 on Plasma had a base LTV of 0 before the incident and are used as collateral only through their E-Mode categories. On Aave V4, each of the following reserves receives a new collateral configuration with its pre-freeze collateral factor: | Network | Spoke | Asset | Collateral factor | | --- | --- | --- | --- | | Ethereum | Gold | XAUt | 75% | | Ethereum | PAXG Gold | PAXG | 75% | | Avalanche | Main | WAVAX | 73% | | Avalanche | AVAX Correlated | sAVAX | 95% | Positions that moved to the collateral factor 0 configuration after the second wave move to the restored configuration on their next borrow, collateral withdrawal or collateral toggle. Positions that never left their original configuration are unaffected. ## Slope2 reversals The temporary Slope2 reductions from 30 October were reverted on 1 November between 17:57 and 19:51 UTC. The affected stablecoin reserves on Aave V3 and Aave V4, and WETH on the Aave V4 Ethereum Core Hub, are back on their pre-incident interest rate curves. ## Stablecoins USDT, USDC and USDT0, including their bridged versions, stay at LTV 0 on Aave V3, including E-Mode, and at a collateral factor of 0 on Aave V4. Restoring LTV for these assets is the next step we will consider. ## Next steps We continue to monitor the exploiter’s wallets, the reserves affected by the freeze and the Chainlink price feeds that Aave relies on. ---
**Author:** ![mercilex](https://avatars.discourse-cdn.com/v4/letter/m/ad7895/32.png) [@mercilex](https://governance.aave.com/u/mercilex)\ **Post date:** [November 4, 2026, 9:11am UTC](https://governance.aave.com/t/binance-hot-wallet-exploit-aaves-response/25954/26 "2026-11-04T09:11:00Z")
How long do we need to wait for the situation to return to normal? It’s been days since Binance withdrawals have resumed, what risks are holding AAVE back? ---
**Author:** ![Amethyst](https://avatars.discourse-cdn.com/v4/letter/a/919ad9/32.png) [@Amethyst](https://governance.aave.com/u/Amethyst)\ **Post date:** [November 4, 2026, 3:10pm UTC](https://governance.aave.com/t/binance-hot-wallet-exploit-aaves-response/25954/27 "2026-11-04T15:10:28Z")
It really seems like AAVE had the proper solutions already presented to them and instead of implementing them before during or after the kelpdao incident decided to sit on their thumbs and wait for something else to happen. It also seems like other protocols in the space managed to navigate larger exploits without negatively impacting its users. Specfically those who use USDC & USDT as collateral. Because AAVE sat on the solutions and didnt implement its actual users are being punished and are only being given options to protect their positions by paying from their own collateral. So in effect the users are paying for AAVE’s mistakes… for the 2nd time… in 6 months. This erodes trust, especially when the people who got hacked (Binance) are already back up and running and making things right but the people who slept on the problem (AAVE) are making their users pay. Really hope this opens the way for other protocols to step forward and innovate if AAVE is choosing to just wait and see what happens the next time. ---
**Author:** ![Amethyst](https://avatars.discourse-cdn.com/v4/letter/a/919ad9/32.png) [@Amethyst](https://governance.aave.com/u/Amethyst)\ **Post date:** [November 4, 2026, 3:14pm UTC](https://governance.aave.com/t/binance-hot-wallet-exploit-aaves-response/25954/28 "2026-11-04T15:14:46Z")
What exactly do you mean “consider”? So you’re saying there is a real chance that you might not restoring them as collateral? Because if you dont thats a major blow to defi and hurts alot of your users. And not sharing what those considerations are is also hurtful to your users. ---
**Author:** ![0kage.eth](https://avatars.discourse-cdn.com/v4/letter/0/df788c/32.png) [@0kage.eth](https://governance.aave.com/u/0kage.eth)\ **Post date:** [November 4, 2026, 5:35pm UTC](https://governance.aave.com/t/binance-hot-wallet-exploit-aaves-response/25954/29 "2026-11-04T17:35:07Z")
Published an onchain study of liquidity risks that freezable collateral can create in permissionless lending, using Binance attacker’s activity on Aave as a case study. Key takeaways: - Traced the onchain timeline from the attacker’s first USDT deposit into Aave through the Guardians’ V3/V4 freezes. - Attacker supplied **60M USDT** and borrowed **19,762 WETH**. Earlier USDT-to-ETH swaps on 0x and 1inch suggest a frantic effort to escape issuer freezes. - Tether blacklisted the aggregation wallet **3m36s after the first Aave deposit** ; Circle followed after **7 minutes**. These actions targeted specific wallets, not the entire attacker cluster. - From the first borrow, **43 minutes** elapsed before the Ethereum V4 freeze and **48m12s** before the first V3 Core freeze. - The first V3 Core freeze came **45m48s after Tether’s blacklist** and **42m24s after Circle’s**. - Just after the WETH borrowing, Aave held **373,618 WETH of available cash** , against **656,272 WETH of borrow-cap headroom**. With sufficient eligible collateral, cash was the tighter constraint. Time also was not a constraint for attacker. - A historical fork test using assumed stablecoin funding exhausted the earlier snapshot’s **398,862 WETH cash** , reaching **100% utilisation**. He had 3min46s to execute this (fortunately he ended up only with 19762 WETH) - In the 100% utilisation scenario, WETH **borrow APR rises from approximately 1.94% to 8.2%** , significantly increasing stress on WETH borrowers Discuss this “what-if” scenario in detail. Hope that helps in figuring out better methods to handle scenarios where future attackers dump huge amounts of freezable assets as collateral. > **[Freezable asset risk to permissionless lending](https://theunderwritehq.substack.com/p/freezable-asset-risk-to-permissionless)** > > I use onchain data from the Binance attack to explore Aave’s liquidity, collateral recovery, and emergency controls under stress. [Previous page](https://governance.aave.com/t/binance-hot-wallet-exploit-aaves-response/25954.md?page=1)