Aave Reopens Markets but Keeps Nine Assets at Zero LTV

Aave reopened its V3 and V4 lending markets on 30 October 2026 after a 16‑hour freeze triggered by a Binance hot‑wallet exploit. New deposits and borrowing are back online, but nine tokens – USDT, USDC, USDT0, POL, WAVAX, sAVAX, XAUT, PAXG and OP – remain at a zero loan‑to‑value (LTV) setting, meaning they cannot be used as collateral for fresh loans. The protocol said its smart contracts were untouched and all existing positions stayed fully collateralised. The freeze had been a precaution after a wallet linked to the Binance attacker deposited 60 million USDT and borrowed roughly $44.6 million worth of WETH.

Background

The emergency pause came after the Binance exchange reported a hot‑wallet breach on 29 October 2026, an incident that Elliptic estimated caused losses of about $6.43 billion. The attacker used the compromised Binance signing keys to move funds across ten blockchain networks, eventually depositing a large USDT tranche into Aave V3 Ethereum Core and borrowing Wrapped Ether. Risk monitoring firms LlamaRisk and TRM Labs highlighted that the attacker’s position was over‑collateralised – roughly $59.9 million in USDT against $43.8 million in debt – and that no other Aave users were directly exposed. In response, Aave’s guardians froze 175 reserves on V3 across 16 networks and 117 reserves on V4 across four networks, while keeping Horizon real‑world asset markets open because they use permissioned collateral. The freeze halted new deposits and borrowing but allowed withdrawals, repayments and liquidations to continue, preserving liquidity for existing lenders. After a joint war‑room involving Aave Labs, TokenLogic and Certora assessed the situation, the protocol staged a four‑wave unfreeze, restoring most functionality while keeping the nine listed assets at zero LTV as a temporary safeguard.

What happened

According to tokenpost.com, Aave announced on 30 October that it had reopened both V3 and V4 markets, restoring the ability for users to make new deposits and borrow assets, but it kept nine specific tokens at a zero LTV as a continued precaution. portalcripto.com.br added that the affected tokens include USDT, USDC, USDT0, POL, WAVAX, sAVAX, XAUT, PAXG and OP, and that wrapped and bridged versions of these tokens are also subject to the same restriction. cryptotimes.io reported that the protocol’s X post confirmed the markets were unfrozen after the Binance hot‑wallet exploit, reiterating that the nine tokens cannot serve as collateral for new loans and that the smart contracts were not compromised. coingabbar.com detailed the unfreeze process, noting that the DAO’s X update at roughly 13:57 UTC confirmed the markets were open again after a 16‑hour pause, and that the guardians executed the reopening in four waves, first unfreezing V3 reserves with zero borrowing power, then applying the zero‑collateral setting on V4, before restoring borrowing capacity for most assets. All sources agree that existing positions remained fully collateralised and that the zero‑LTV setting applies only to new risk changes, not to already open loans.

Market impact

LlamaRisk’s analysis on 30 October showed that the attacker’s single position held $59.9 million in USDT collateral against $43.8 million in debt, a loan‑to‑value of roughly 73 percent, and that this position did not threaten Aave’s liquidity providers. During the freeze, utilization rates in stablecoin pools rose to between 92 percent and 100 percent, prompting LlamaRisk to lower the Slope2 interest parameter. When the markets reopened, risk adjustments removed about $3.7 billion of idle capacity on V3 and $130 million on V4, according to the same source. The freeze also caused Aave’s native stablecoin GHO to slip from $0.998 to $0.997 as holders redeemed nearly $4.6 million. Binance reported that roughly $3 billion of its funds were frozen on‑chain after the hack, and the exchange set aside more than $6.34 billion to cover about 80 percent of the estimated $6.3 billion loss.

Why it matters

The reopening restores normal lending activity for the majority of Aave’s users, allowing fresh capital inflows and borrowing that were stalled during the freeze. Keeping nine assets at zero LTV reduces the protocol’s exposure to rapid asset swaps that could be used to launder stolen funds, a risk highlighted by the attacker’s use of USDT to obtain WETH, an asset that cannot be frozen by its issuer. The high utilization of stablecoin reserves during the pause demonstrated how quickly liquidity can become constrained in a crisis, prompting Aave’s risk team to adjust interest parameters and borrowing caps to protect suppliers. The incident also underscores the interconnectedness of centralized exchanges and DeFi platforms; a breach at Binance quickly propagated to Aave, prompting a coordinated response across multiple risk teams and governance bodies. Finally, the fact that Aave’s smart contracts remained untouched and all positions stayed over‑collateralised reinforces confidence in the protocol’s technical resilience, even as it navigates external security shocks.