Aave (AAVE) Reopens Markets After Binance Hack, Price Up 9%

By Nodora News · 1 November 2026 · Updated 1 November

Aave (AAVE) has unfrozen its V3 and V4 lending markets after the $6.3B Binance hack, but nine attacker-held assets still cannot back new loans.

Aave (AAVE), the largest decentralized lending protocol in crypto, has reopened the markets it froze after the record $6.3 billion Binance hack, but it is still blocking nine assets held by the attacker from backing new loans. The AAVE token has climbed about 9% over the past 24 hours to roughly $135.6 on OKX, recovering much of the drop it took in the days after the breach.

Key takeaways

• Aave froze 292 lending reserves after the Binance hack: 175 on Aave V3 across 16 networks and 117 on Aave V4.
• Aave says all V3 and V4 markets are now unfrozen, with the rollback carried out in four planned waves.
• USDT, USDC, USDT0, POL, WAVAX, sAVAX, XAUt, PAXG and OP stay at zero borrowing power as collateral for now.
• The attacker's only Aave position (60M USDT backing a 19,762 WETH loan) is over-collateralized and does not put suppliers at risk, according to risk steward LlamaRisk.
• AAVE trades near $135.6, up about 9% in 24 hours.

What Happened at Aave After the Binance Hack?

Hackers drained about $6.3 billion from Binance's hot wallets on Thursday, Oct. 29, in what is now the largest crypto theft on record. You can read our full report on the Binance hack.

Within minutes, one of the attacker's wallets went to Aave. Between 20:58 and 21:01 UTC, it supplied 60 million USDT on Aave V3's Ethereum Core market and borrowed 19,762 WETH (wrapped ether), worth about $44.6 million at the time.

The worry was simple: the attacker could swap stolen coins into any asset Aave lists and borrow against them, turning stolen funds into clean loans. To stop that, a "war room" of LlamaRisk, Aave Labs, TokenLogic and Certora decided to freeze markets on every network. Guardian multisigs (wallets that need several signers to act) froze reserves between 21:42 and 23:04 UTC.

During the freeze, users could still repay loans and withdraw funds, and liquidations kept running. New deposits and new borrowing were blocked. Aave's Horizon market for real-world assets stayed open, because its collateral is permissioned and the attacker could not use it.

How Aave Reopened Its Markets

LlamaRisk laid out a four-wave rollback plan on Aave's governance forum:

• Wave 1: unfreeze every Aave V3 reserve frozen in the incident, with loan-to-value (LTV) kept at zero at first.
• Wave 2: give the nine "keep-list" assets a collateral factor of zero on Aave V4.
• Wave 3: restore LTV on most Aave V3 reserves.
• Wave 4: unfreeze the Aave V4 reserves.

Aave said on Friday, Oct. 30, that "all markets are now unfrozen across Aave V3 and V4." On-chain data reviewed by independent outlets showed the Ethereum Core market unfrozen at about 12:26 UTC and LTV restored on 13 reserves at about 13:37 UTC that day, roughly 16 hours after the freeze began.

LTV is the share of a deposit's value you can borrow against it. An LTV of zero means the asset can still be deposited, withdrawn, borrowed and repaid, but it adds no new borrowing power when used as collateral.

Why Nine Assets Are Still Restricted

The nine restricted assets are the ones spread across the attacker's address cluster: USDT, USDC, USDT0, POL, WAVAX, sAVAX, XAUt, PAXG and OP, including their bridged and wrapped versions. Keeping them at zero LTV means the attacker cannot deposit them to borrow other coins on Aave.

For ordinary users, existing Aave V3 positions that use these assets as collateral keep their liquidation thresholds, so their health factors do not change. On V4, positions keep their current settings until the user takes a new borrow or changes collateral.

LlamaRisk also made two temporary risk changes while markets were frozen:

• It lowered interest-rate curves on the biggest stablecoin reserves and on WETH on the V4 Ethereum Core hub, so borrow rates at full use do not exceed 10% APR. Supplier withdrawals had pushed those reserves to 92%–100% utilization.
• It cut borrow caps on the largest borrow paths to about 2% above pre-hack levels, removing about $3.7 billion of unused capacity on V3 and $130 million on V4, so a flood of new borrowing could not hit all at once.

Liquidity is coming back. Idle USDC on the Ethereum Core market was back to about $89 million by late Friday, up from about $95,000 earlier that day.

Aave (AAVE) Price Reaction

Aave's governance token was among the hardest hit after the breach. LlamaRisk noted early on that AAVE and LINK had fallen about 9% after the drain, more than ETH and BTC, as governance tokens held by the attacker came under selling pressure.

The recovery since the reopening has been strong. Prices on OKX at about 13:55 UTC on Oct. 31:

• AAVE: $135.6, up about 9.4% in 24 hours (24h range $123.3–$136.1)
• ETH: $2,252, up about 1.3%
• BTC: $77,500, up about 0.7%

You can follow live prices on Nodora Charts.

What to Watch Next for Aave Holders

• Restoring LTV on the keep-list. LlamaRisk says the nine assets stay at zero LTV until it sets conditions to restore them. Watch the governance forum for that update.
• Interest rates and borrow caps. The 10% rate ceiling and tighter caps are temporary, and LlamaRisk plans to review them once markets are back to normal.
• Binance withdrawals. Binance has said it aims to start reopening withdrawals in stages on Sunday, Nov. 1, subject to security checks. A smooth reopening could ease pressure on DeFi liquidity.
• The attacker's WETH loan. The position remains subject to normal liquidation if its collateral value falls.

Spot Bitcoin ETFs also felt the shock this week, with heavy outflows after the hack, as we covered in Bitcoin ETFs lose $643M in a day.

This article is for information only and is not financial advice.

#Aave #DeFi #Binance #Hack #Lending

This article is general information, not financial advice.