Binance Hot Wallet Suffers Major Theft: Aave's Official Coordinated Response and Emergency Freeze of Lending Markets Across Networks—In-Depth Review

Author: LlamaRisk (Aave risk service provider) & Aave Labs

Compiled by: TechFlow

TechFlow Editor's Note:After Binance suffered the largest hot-wallet theft in cryptocurrency history, valued at $5.5 billion, the stolen assets quickly spread into the core of mainstream DeFi lending. On-chain records show that shortly after the theft, the hacker deposited $60 million in USDT collateral into the Aave V3 Ethereum Core market and quickly borrowed 19,762 WETH, worth approximately $44.6 million, attempting to use lending leverage to launder the assets.

Faced with a sudden systemic black swan, Aave risk service provider LlamaRisk urgently established a joint emergency war room with Aave Labs, TokenLogic, and Certora within 10 minutes. To prevent the hacker from converting the large amount of stolen funds into other tokens and continuing to inject them into lending pools, the Guardian emergency multisig took decisive action, implementing a comprehensive freeze on 175 Aave V3 reserve pools across 16 networks, including Ethereum, Arbitrum, Optimism, Avalanche, and Base, as well as the Aave V4 markets.

TechFlow provides a full in-depth translation of this authoritative official emergency report published on the Aave Governance Forum. The report details the hacker's sole deposit-and-borrow position on Aave (currently with normal collateralization and protected by liquidation mechanisms), Chainlink oracles' robust performance under severe price volatility, GHO stablecoin depeg stress testing, and the subsequent phased unfreezing roadmap after Binance's risk subsided.

Last updated: October 30, 2026, 01:00 UTC.

On October 29, 2026, at 20:24 UTC, a Binance hot wallet on Ethereum transferred approximately 63 types of tokens and 167,464 ETH to a single address in one transaction.

Within the following minutes, the same attacker address also received 28,006 ETH from a second Binance hot wallet on Ethereum, while simultaneously receiving multiple hot-wallet transfers from Arbitrum, Optimism, and Avalanche.

Subsequently, at 23:04 UTC, a second inflow of up to 444,537 AVAX appeared on Avalanche, indicating that more than two hours after the first attack, the risk of hot-wallet private-key theft was still spreading.

Incident Details: The Hacker's Single Interaction with the Aave Protocol and On-Chain Anomalies

After the theft, the hacker quickly dispersed the massive stolen funds into more than 20 newly generated on-chain wallets and began aggressively selling UNI, LINK, and AAVE tokens on major decentralized exchanges (DEXs), converting them into native Ethereum (ETH).

Between 20:58 and 21:01 UTC, an associated address in the hacker's wallet cluster deposited $60 million in USDT collateral into the Aave V3 Ethereum Core market and borrowed 19,762 WETH (approximately $44.6 million at market prices at the time).

This borrowing occurred about 40 minutes before the protocol executed its first emergency freeze at 21:42. Since 21:01, none of the hacker's wallets have interacted with Aave again, and this remains the only borrowing position the hacker has opened across all Aave versions and branch markets on all networks.

As of now, the position holds $59.9 million in USDT collateral against $43.8 million in debt exposure. Because the position remains overcollateralized and is still subject to normal liquidation mechanisms, it does not pose a material bad-debt risk to Aave liquidity providers.

Emergency Response: Guardian Emergency Multisig Freezes Core Lending Markets Across 16 Chains

Within 10 minutes of the initial security alert report, the LlamaRisk team quickly established a Joint War Room with Aave Labs, TokenLogic, and Certora.

After assessment, the joint expert team unanimously decided to emergency freeze Aave lending markets across all public networks. This is because the hacker could fully convert stolen tokens into any collateral asset supported by the protocol through on-chain swaps; if only the reserve pools holding the stolen tokens were individually frozen, the hacker could still continue exploiting the protocol through other asset paths.

The joint team chose to execute the freeze mechanism because the emergency Guardian can quickly lift the state once the situation stabilizes; by contrast, the traditional approach of significantly lowering supply Caps would require a full on-chain governance proposal vote, which typically takes about five days to fully restore.

The market freeze operation completely prevents any user, including the hacker, from opening new deposit or borrowing positions. Meanwhile, existing normal users retain the right to repay and withdraw, and on-chain liquidation processes continue to operate normally.

It should be noted that because reserve pools do not accept new deposits during the freeze, users cannot add additional collateral. Therefore, while the freeze remains in effect, proactively repaying debt is the only effective way for borrowers to improve their health factor.

Subsequently, we worked closely with the Aave Labs engineering team to prepare and fully simulate freeze transactions for each public network and formally submitted them to the Guardian emergency multisig wallet. Multisig members completed signing and on-chain execution between UTC 21:42 and 23:04.

In this joint defense operation, a total of 175 Aave V3 reserve pools across 16 public networks and 117 Aave V4 markets across 4 networks were emergency frozen. The coverage includes:

This includes the Ethereum mainnet core markets and Prime institutional markets, as well as Aave V3 markets on Arbitrum, Avalanche, Base, BNB Chain, Celo, Gnosis, Ink, Linea, Mantle, MegaETH, Monad, Optimism, Plasma, Polygon, and X Layer; it also covers Aave V4 markets on Ethereum mainnet, Avalanche, Base tokenized equities, and the Arc institutional-only branch.

Notably, the Horizon real-world asset (RWA) markets were not included in the freeze scope because all collateral assets in those markets have strict Permissioned access controls, making them completely inaccessible to the hacker; additionally, no markets were subject to Pause.

At the same time, we maintain second-level, around-the-clock real-time tracking of the hacker address cluster, closely monitoring every associated wallet on Ethereum, Arbitrum, Optimism, and Avalanche to prevent new probing attempts against Aave, while closely watching the Chainlink oracle price feeds relied on by Aave.

Market impact assessment: stable oracle operations, pressure on governance tokens, and GHO peg status

Throughout the extreme black swan event, Chainlink and other oracle price-feed systems remained highly stable and operating normally from start to finish. As of UTC 00:55, Ethereum and Bitcoin prices had fallen about 4% cumulatively since the hacker's theft.

The decentralized governance tokens held by the hacker fell more sharply: AAVE and LINK dropped about 9%, UNI dropped about 8%, and ARB dropped about 6%. The global freeze implemented in this incident effectively prevented the hacker from depositing these tokens under selling pressure into Aave as collateral to cash out.

Currently, existing borrowing positions collateralized by the above tokens within the protocol remain healthy. As the hacker continues selling on-chain, the risk team is closely monitoring potential cascading liquidation risks.

Among major stablecoins, the key assets remained firmly pegged. Aave's native stablecoin GHO was trading at about $0.998 before the hacker's raid. During UTC 21:49 to 22:07, holders redeemed approximately 4.6 million GHO for USDT through the GHO Stability Module (GSM), causing the price to briefly dip to $0.997; it has since remained stable within that reasonable fluctuation range.

Follow-up Recovery Roadmap: Dynamic Utilization Monitoring and Phased Unfreezing Plan

The overall on-chain situation remains dynamic and evolving. The risk team will continue to monitor the hacker's wallet cluster and the affected asset price feeds around the clock, and will update the community as soon as new developments emerge.

Aave's related lending markets will remain frozen until the hacker's stolen funds completely stop moving and Binance's official containment and loss-mitigation plan for this vulnerability has made clearer substantive progress.

Subsequently, we will work closely with Aave Labs and other ecosystem service providers to steadily advance a phased, orderly unfreezing plan.

It should be objectively noted that maintaining market freezes for an extended period can also have a structural impact on pool utilization. Because frozen reserve pools no longer accept any new deposits, voluntary withdrawals by large lenders will push up pool utilization and raise borrowing rates; only active repayments by borrowers can bring rates back down.

We are closely monitoring real-time utilization changes across all frozen reserve pools and will prudently assess the specific priority order for subsequent phased unfreezing based on this data.

Source: TechFlow