- A wallet linked to the Binance exploit supplied 60 million USDT to Aave V3 Ethereum Core and borrowed 19,762 WETH, worth about $44.6 million at the time, against that collateral
- Guardian multisigs froze 175 reserves across 16 networks on Aave V3 and 117 reserves across four networks on Aave V4 between 21:42 and 23:04 UTC
- Aave says the borrow position remains over-collateralized, with $59.9 million of USDT collateral against $43.8 million of debt, and that freezing was chosen over cutting supply caps because a governance vote would have taken about five days
Aave’s own governance forum published a detailed account of how the Binance hack reached its protocol within minutes of the exploit beginning. At 20:24 UTC on October 29, 2026, a Binance hot wallet on Ethereum sent about 167,464 ETH plus 63 other tokens to a single address in one transaction, and the same address shortly received a further 28,006 ETH from a second Binance hot wallet, along with funds that moved separately on Arbitrum, Optimism and Avalanche.
Between 20:58 and 21:01 UTC, a wallet tied to the exploiter cluster supplied 60 million USDT to Aave V3 Ethereum Core and borrowed 19,762 WETH against it, worth roughly $44.6 million at the time. According to Aave’s forum post, that remained the exploiter’s only interaction with the protocol across any network or version, and the position is over-collateralized, with $59.9 million of USDT backing $43.8 million of outstanding debt, meaning it remains subject to normal liquidation rules rather than posing a direct loss risk to Aave’s suppliers.
Aave Labs, risk manager TokenLogic and security firm Certora formed a response group within about ten minutes of the first reports and chose to freeze markets broadly rather than cut individual supply caps, since a cap reduction requires a governance vote that typically takes around five days to complete. Guardian multisigs executed the freezes between 21:42 and 23:04 UTC, covering 175 reserves across 16 networks on Aave V3 and 117 reserves across four networks on Aave V4. A freeze blocks new supply and new borrowing on an affected reserve while leaving withdrawals, repayments and liquidations unaffected. Aave’s Horizon real-world-asset market, which uses permissioned collateral, was left open throughout.
The stablecoin GHO briefly slipped from about $0.998 to $0.997 as the incident unfolded, and roughly 4.6 million GHO was redeemed for USDT through the GHO Stability Module between 21:49 and 22:07 UTC. A second inflow of 444,537 AVAX arrived on Avalanche at 23:04 UTC, which Aave’s post describes as a sign the underlying compromise was still active at that point, coinciding with when freeze execution finished. By 00:55 UTC on October 30, several governance and infrastructure tokens including AAVE, LINK, UNI and ARB were down between roughly six and nine percent since the drain began.
The full timeline is published on Aave’s own governance forum, which the protocol has used as its primary channel for updates throughout the incident.
Disclaimer: Cryip's content is strictly for educational and informational purposes and does not constitute financial, legal, or investment advice. Cryptocurrency involves significant risk, and readers assume full responsibility for their own financial decisions. Asset references are never endorsements.
To make complex crypto topics accessible to readers at all experience levels, our team uses AI tools strictly to refine language, correct grammar, and simplify terminology. AI is never used to draft facts, source information, or form conclusions. Every article is fact-checked and approved by a human editor before publication. Read our full AI Use & Content Policy.
