A Binance hacker utilized Aave V3’s Ethereum Core market to route stolen assets. Between 20:58 and 21:01 UTC on Oct. 29, 2026, the perpetrator deposited 60 million USDT into the decentralized lending protocol. Shortly after, a wallet within the hacker cluster borrowed 19,762 Wrapped Ether (WETH) worth approximately $44.6 million before safety mechanisms could react.
Aave’s smart contracts did not suffer any code leaks or vulnerability exploits. The intervention by protocol guardians was purely a precautionary measure to curb the movement of stolen funds. Nonetheless, halting the market triggered a cascade of issues for other users.
A 41-Minute Gap Before Protocol Freeze
The initial freeze transaction executed by Aave protocol guardians did not take place until 21:42 UTC. The emergency pause was implemented to prevent the hacker from depositing remaining stolen funds still under their control.
According to analysis from risk provider LlamaRisk, the hacker’s borrow position held $59.9 million in USDT collateral against $43.8 million in WETH debt. This indicates the position remained overcollateralized, with the collateral value exceeding total debt at the time of the transaction.
Why Regular Users Were Also Impacted
The emergency mechanism blocked all new deposits into the market. On the other hand, capital withdrawals for lenders and loan repayments for borrowers remained normally open on the protocol.
Under normal circumstances, surging borrow rates attract fresh liquidity inflows to ease pool strain. But with new deposits blocked, rising interest rates failed to draw new capital into the system, causing borrowing costs to skyrocket in a short period.
As a result, regular users entirely unrelated to the exploit found themselves in a difficult bind. Active borrowers could not deposit additional collateral to secure their loan positions. At the same time, accumulating interest continued to accrue, heightening their liquidation risks.
Design Debate and Asset Restriction Status
The intervention sparked broader debates over decentralized lending architecture. Supporters of Aave’s pooled model clashed with the founder of rival protocol Morpho, who advocates for isolated lending markets where risks from a single asset or event cannot spill over into other assets within the system.
Aave has since resumed lending market operations on versions V3 and V4. Even with markets reopened, the protocol kept 9 specific assets restricted from providing new borrowing capacity as collateral.
For DeFi lending market participants, the Aave incident serves as a clear reminder: liquidation risks do not stem solely from token price drops, but can also arise when protocol managers shut down collateral channels to protect the system.
Reported by crypto.news.
Read also: What Is DeFi (Decentralized Finance)?
Read also: Binance Breached, Standard Chartered Says $100 Uniswap Target Could Be Too Low
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
