Decentralized finance lending protocol Aave froze lending markets across 16 blockchain networks following a major security breach involving Binance hot wallets, in which attackers drained more than 195,000 ethereum (ETH) and millions of dollars in altcoins across multiple chains.
The exploit began at 3:24 p.m. EST on October 29, 2026, when an attacker initiated a transaction transferring 167,464 ETH and 63 other tokens from an Ethereum-based Binance hot wallet. Minutes later, the same attacker received an additional 28,006 ETH from a second Binance wallet, with assets transferred across Arbitrum, Optimism and Avalanche. The vulnerability remained active for more than two hours, with continued inflows including 444,537 AVAX on Avalanche.
Following the initial breach, the attacker dispersed funds across more than 20 wallet addresses and began selling tokens such as Uniswap (UNI), Chainlink (LINK) and Aave (AAVE) on decentralized exchanges.
Aave's Emergency Response
Between 3:58 p.m. EST and 4:01 p.m. EST, before protective measures were implemented, a wallet linked to the attacker deposited $60 million in tether (USDT) into Aave and borrowed approximately $44.6 million in wrapped ether (WETH). The position remained overcollateralized with $59.9 million in collateral backing $43.8 million in debt, posing no direct insolvency risk to Aave liquidity providers.
Security teams from Aave Labs, Tokenlogic, Certora and partner security providers established a joint emergency response group within 10 minutes of initial reports. To prevent the attacker from depositing stolen tokens, protocol guardians implemented a global freeze across major networks including Ethereum, Arbitrum, Avalanche, Base, Optimism, Polygon and BNB Chain.
Guardian multisignature wallets executed emergency freeze actions between 4:42 p.m. EST and 6:04 p.m. EST, halting 175 reserves on Aave V3 across 16 networks and 117 reserves on Aave V4 across four networks. Existing users can repay debts and withdraw collateral, but new deposits and borrowing remain blocked. The permissioned real-world asset market remains operational.
Binance's Investigation and Response
Binance revealed that the security breach involved additional points of compromise beyond an initially suspected compromised laptop. The exchange confirmed that approximately $3 billion in impacted assets had been frozen through cooperation with its partners.
Unauthorized outflows stopped after Binance suspended withdrawal services. Deposits remained unaffected, and the exchange remained on track to resume withdrawals within its previously announced 45-hour timeline. Binance pledged to reimburse all losses using its Secure Asset Fund for Users (SAFU) and company funds.
The exchange said it was coordinating with law enforcement to investigate the attack and recover affected assets.
Market Impact
Cryptocurrency markets came under immediate pressure following the exploit, with bitcoin falling to $76,320 and ether declining to $2,170. Tokens directly sold by the attacker experienced steeper declines, with AAVE and LINK each falling 9%, UNI dropping 8% and Arbitrum (ARB) declining 6%.
Major fiat-backed stablecoins maintained their pegs, although Aave's GHO stablecoin briefly slipped to $0.997 as users redeemed 4.6 million GHO for USDT.
Protocol engineers indicated that markets would remain frozen pending further containment updates and stabilization of the attacker's wallet activity. A staged process to lift restrictions will be evaluated once conditions are met.
