Binance Wallet Incident: How the Aave Lending Markets Responded

According to the October 30 Aave ecosystem risk report, an address linked to the Binance incident deposited 60 million USDT on Aave V3 Ethereum Core and borrowed 19,762 WETH in a sequence around 20:58–21:01 UTC on October 29.

That mechanism matters because a USDT blacklist is a restriction on particular Tether-issued balances, not an automatic freeze of WETH issued or transferred through another protocol. But the existence of the borrowing does not establish a realized loan default, loss to suppliers, or automatic erasure of the debt.

LlamaRisk described the position as overcollateralized at its October 30 review checkpoint. CYA therefore records the borrowing and the risk response, not an invented bad-debt figure or victim recovery outcome.

The risk report dates the guardian response to approximately 21:42–23:04 UTC on October 29. The distinction between a reserve freeze and a full pause is material to depositors: liquidity and withdrawal conditions may change, but the same restrictions do not apply to every operation.

The October 30 LlamaRisk follow-up proposed temporary reductions to selected interest-rate slope parameters after market freezes increased utilization and borrowing rates in affected reserves. That is a separate operational consequence from the incident-linked borrowing position itself.

A governance proposal is not proof that the changes were executed. CYA records the proposal as contemporaneous context and requires separate implementation evidence before stating that any rate parameters were changed on-chain.

The hack-related USDT/WETH position was reported as overcollateralized at the reviewed checkpoint. Without proven bad debt, unpaid insolvency, inaccessible user funds, or a reimbursement obligation, it would be incorrect to label this as a loss incurred by all Aave depositors.

Likewise, the broader Binance affected-assets estimate, Tether/Circle freezes, recovered funds, and debt at Aave are not interchangeable amounts. Adding them together would create a misleading total.

CYA has added an emergency governance action to the existing Aave protocol record, with linked primary evidence. The event's impact is critical and Aave's status is time-bounded as limited while the reviewed market restrictions were in place. This is not a permanent platform shutdown, and it does not establish Aave itself was hacked.

The next checkpoints are the specific markets and reserves reopened, actual governance parameter executions, whether the incident-linked loan was repaid or liquidated, and any realized protocol deficit. Unverified outcomes remain unknown, not presumed failures.

Inspect the canonical Aave platform timeline and evidence. For the stablecoin issuer side, see Stable or Gone's USDT/USDC freeze analysis. For the exchange incident, see Historical Exchange Index's Binance record.

• LlamaRisk / Aave Governance: Binance Hot Wallet Exploit — Aave's Response (October 30, 2026). Collateral and borrowing, number of frozen reserves, continued permissions, Aave risk interpretation.
• LlamaRisk / Aave Governance: Temporary Slope2 Reductions (October 30, 2026). Proposed risk and interest-rate changes; publication alone does not confirm execution.
• Binance: Security Incident Update (October 30, 2026). Initial exchange-side incident estimate, response and uncertainty around the root cause.