Quick answer: In the Aave unfreeze, the protocol reopened its V3 and V4 markets on Oct. 30, 2026, about 17 hours after the Binance hack, but kept nine assets including USDT and USDC at zero loan-to-value. The exploiter’s 19,762 WETH loan is still open, with an on-chain health factor of 1.054 on Oct. 31.
The Aave unfreeze is done: the lending protocol reopened all of its V3 and V4 markets on Oct. 30, 2026, after freezing them during the Binance hot-wallet drain. Nine assets still cannot be used as collateral, and the loan the attacker took out on Aave is drifting toward liquidation.
What happened in the Aave unfreeze
At 20:24 UTC on Oct. 29, a Binance hot wallet sent out 167,464 ETH, and a second hot wallet sent another 28,006 ETH, according to a timeline by risk manager LlamaRisk on the Aave governance forum. We covered the theft itself in our report on the Binance hack and the frozen funds.
Between 20:58 and 21:01 UTC, a wallet tied to the exploit supplied 60 million USDT to Aave V3 Ethereum Core. It then borrowed 19,762 WETH, worth about $44.6 million at the time. That was roughly 40 minutes before Aave’s first freeze.
Guardians froze reserves between 21:42 and 23:04 UTC. The action covered 175 reserves on V3 across 16 networks and 117 on V4 across four networks. Aave left its Horizon real-world-asset market open.
LlamaRisk said it chose a freeze because the guardian can reverse it at once. Cutting supply caps instead would have required a governance vote taking about five days.
Aave announced the unfreeze on X at 13:57 UTC on Oct. 30, exchange.news reported. CoinMarketCap and CryptoSlate confirmed the reopening and the collateral limits.
Nine assets stay locked as collateral
The markets are open, but not fully. Nine assets remain at a loan-to-value (LTV) of zero, so they cannot back new borrowing. The list is USDT, USDC, USDT0, POL, WAVAX, sAVAX, XAUt, PAXG and OP.
Users can still supply, withdraw, borrow and repay these tokens as normal. LlamaRisk said it will publish the conditions for restoring their LTV.
Other changes landed in the 13:49 UTC update on Oct. 30. Utilization had hit 92% to 100% in some pools. So Aave cut the slope of the rate curve to keep the top borrow rate at or below 10% a year.
Aave also cut borrow caps to about 2% above pre-exploit levels. That removed around $3.7 billion of unused borrowing room on V3 and $130 million on V4. It queued cuts to GHO caps as well.
Why the Aave unfreeze matters
The freeze worked as an emergency brake. The attacker’s position was over-collateralized, with about $59.9 million of USDT backing $43.8 million of debt at LlamaRisk’s snapshot. Suppliers never faced bad debt.
Even so, the episode showed how fast stolen funds can move into DeFi. The attacker turned stolen money into collateral in minutes and took a large ETH loan. TRM Labs has linked the Binance theft to North Korea’s TraderTraitor group, as our TraderTraitor report explains.
Forum members have floated new defenses, such as limits on how fast borrowing can grow and cooldowns on large deposits. One developer offered automated cap tooling for free. Aave has not adopted any of these yet. For the wider picture, see our guide to DeFi risks.
The data: an exploiter loan close to the line
CryptoVank queried Aave’s V3 pool contract on Ethereum directly, at block 26,312,278 on Oct. 31. The exploiter wallet showed $59.92 million of collateral against $44.35 million of debt. Its LTV is zero and its liquidation threshold is 78%.
That gives a health factor of 1.054. The debt is in ETH, so the loan gets riskier when ETH rises. At the current spread, liquidation starts if ETH climbs about 5.4%, to roughly $2,364.
ETH traded at $2,242.93 at 10:54 UTC on Oct. 31, almost flat over 24 hours, per CoinGecko. It briefly touched that level in the week before the hack.
The market impact was short-lived. AAVE fell about 9% in the first hours, LlamaRisk said, but it was at $133.19 at 10:54 UTC on Oct. 31. That is up 6.35% in a day, per CoinGecko. Aave’s total value locked was about $16.09 billion, per DefiLlama. The GHO stablecoin dipped only from $0.998 to $0.997.
What to watch next
First, watch the conditions LlamaRisk publishes for restoring LTV on the nine assets. USDT and USDC are among Aave’s biggest collateral types.
Second, watch ETH near $2,364. A liquidation would repay the WETH debt and hand liquidators part of the USDT collateral. Tether and Circle have already frozen about $2.39 billion tied to the hack, Decrypt reported. It is still unclear whether anyone can seize frozen USDT from the pool.
Third, watch for a governance vote on borrow-speed limits.
If you spend crypto day to day, our crypto card guide compares options that keep funds off exchanges.
Aave unfreeze FAQ
Is Aave safe to use after the Binance hack?
Aave reopened its V3 and V4 markets on Oct. 30, 2026. LlamaRisk said suppliers faced no bad debt, because the exploiter’s position was over-collateralized. Nine assets, including USDT and USDC, still cannot be used as new collateral.
Which assets are still restricted on Aave?
USDT, USDC, USDT0, POL, WAVAX, sAVAX, XAUt, PAXG and OP stay at zero LTV. You can supply, withdraw, borrow and repay them, but they cannot back new loans until LlamaRisk sets conditions to restore them.
When could the exploiter’s Aave loan be liquidated?
On Oct. 31, 2026, the loan had a health factor of 1.054 on-chain. Since the debt is 19,762 WETH backed by USDT, liquidation starts if ETH rises to about $2,364, around 5.4% above its price at 10:54 UTC.
Sources
- Aave governance forum: Binance hot wallet exploit, Aave’s response
- CoinMarketCap Academy: Aave unfreezes markets, nine assets at zero LTV
- CryptoSlate: Aave reopens frozen markets but blocks new collateral loans
- exchange.news: Aave V3 and V4 markets unfrozen
- Decrypt: Morning Minute on the Binance hack
- CoinGecko: Aave price and Ethereum price
- DefiLlama: Aave TVL
This article is for information only and is not financial advice.
