Binance Hot Wallet Suffers Major Theft: Official Coordinated Response from Aave and Emergency Freeze Across the Entire Lending Market – In-Depth Post-Mortem

Author: LlamaRisk (Aave Risk Service Provider) & Aave Labs

Compiled by: TechFlow

TechFlow Summary: Following Binance's experience of the largest hot wallet theft in cryptocurrency history, amounting to $5.5 billion, the stolen assets rapidly spread into the core of mainstream DeFi lending protocols. On-chain records show that shortly after the attack, the hacker deposited $60 million worth of USDT collateral into the Aave V3 Ethereum Core market and quickly borrowed approximately 19,762 WETH (valued at around $44.6 million), attempting to launder the stolen funds through borrowing leverage.

Facing the sudden systemic black swan event, Aave's risk service provider LlamaRisk urgently formed a Joint War Room within 10 minutes, bringing together Aave Labs, TokenLogic, and Certora. To prevent the hacker from converting the massive stolen funds into other tokens and continuing to inject them into lending pools, the Guardian emergency multisig took decisive action, implementing a comprehensive freeze on 175 Aave V3 reserve pools and Aave V4 markets across 16 networks, including Ethereum, Arbitrum, Optimism, Avalanche, Base, and others.

TechFlow has conducted an in-depth full-text compilation of this authoritative official emergency bulletin published on the Aave governance forum. The report thoroughly outlines the hacker's only deposit-borrow position on Aave (currently adequately collateralized and protected by liquidation mechanisms), Chainlink oracles' robust performance amid severe price volatility, stress testing of the GHO stablecoin's decoupling resilience, and the subsequent phased unfreezing roadmap following the containment of risks at Binance.

Last updated: UTC 01:00, October 30, 2026.

On October 29, 2026, at UTC 20:24, a Binance hot wallet on Ethereum transferred approximately 63 different tokens and 167,464 ETH to a single address in a single transaction.

Within the next few minutes, the same attacker address received 28,006 ETH from a second Binance hot wallet on Ethereum, while simultaneously receiving multiple fund transfers from hot wallets on Arbitrum, Optimism, and Avalanche.

Subsequently, at UTC 23:04, a second wave of fund inflows reaching 444,537 AVAX was detected on Avalanche, indicating that more than two hours after the initial attack, the risk of private key compromise for hot wallets continued to spread.

Incident Timeline: Hacker's Single Interaction with the Aave Protocol and On-Chain Anomalies

After the theft, the hacker rapidly dispersed the massive stolen funds across more than 20 newly generated on-chain wallets and began heavily selling tokens such as UNI, LINK, and AAVE on various decentralized exchanges (DEXs), converting them into native Ethereum (ETH).

Between UTC 20:58 and 21:01, an affiliated address from the hacker's wallet cluster deposited $60 million USDT collateral into the Aave V3 Ethereum Core market and borrowed 19,762 WETH (valued at approximately $44.6 million at the prevailing market price).

This borrowing operation occurred approximately 40 minutes before the protocol executed its first emergency freeze at 21:42. Since 21:01, none of the hacker's wallets have interacted with Aave again, marking this as the only borrowing position established by the hacker across all versions and forked markets on the entire Aave network.

As of now, this position holds $59.9 million USDT in collateral against a $43.8 million debt exposure. Because the position remains over-collateralized and is still subject to standard liquidation mechanisms, it poses no material bad debt risk to Aave's liquidity providers.

Emergency Response: Guardian Emergency Multisig Freezes Core Lending Markets Across 16 Chains

Less than 10 minutes after the initial security alert report emerged, the LlamaRisk team swiftly formed a Joint War Room together with Aave Labs, TokenLogic, and Certora.

After evaluation, the joint expert panel unanimously decided to urgently freeze Aave's lending markets across all public blockchain networks. This was because the hacker had the capability to convert stolen tokens into any supported collateral asset via on-chain swaps. If only the reserve pools of the stolen tokens were individually frozen, the hacker could still continue to infiltrate the protocol through other asset pathways.

The joint team opted for the freeze mechanism because the Emergency Guardian can swiftly lift the status once the situation stabilizes. In contrast, adopting the traditional approach of significantly lowering supply caps would require going through the complete on-chain governance proposal voting process, which typically takes about five days to fully restore.

The market freeze operation completely prevents any user (including the hacker) from opening new deposit or borrowing positions. Meanwhile, existing legitimate users retain their rights to repay debts and withdraw funds, and on-chain liquidation processes will continue to operate normally.

It should be noted that since frozen reserve pools no longer accept new deposits, users cannot add additional collateral. Therefore, during the freeze period, actively repaying debt becomes the only effective method for borrowers to improve their health factors.

Subsequently, we closely coordinated with the Aave Labs engineering team to prepare and thoroughly simulate freeze transactions for each public chain network, formally submitting them to the Guardian emergency multisig wallet. Multisig members sequentially completed signing and on-chain execution between UTC 21:42 and 23:04.

In this joint defense operation, a total of 175 Aave V3 reserve pools across 16 public chain networks and 117 Aave V4 markets covering 4 networks were urgently frozen. Specific coverage includes:

Ethereum mainnet core market and Prime institutional market, as well as Aave V3 markets on Arbitrum, Avalanche, Base, BNB Chain, Celo, Gnosis, Ink, Linea, Mantle, MegaETH, Monad, Optimism, Plasma, Polygon, and X Layer; alongside Aave V4 markets on Ethereum mainnet, Avalanche, Base tokenized US equities, and the Arc institutional-only fork.

Notably, the Horizon Real World Assets (RWA) market was not included in the freeze scope because all collateral assets within this market are strictly permissioned, rendering them completely inaccessible to the hacker. Additionally, no markets were paused.

Meanwhile, we maintain second-level, round-the-clock real-time tracking of the hacker's address cluster, closely monitoring every affiliated wallet on Ethereum, Arbitrum, Optimism, and Avalanche to prevent new probing attempts against Aave, while vigilantly monitoring the Chainlink oracle price feeds relied upon by Aave.

Market Impact Assessment: Stable Oracle Operations, Under Pressure on Governance Tokens, and GHO Anchor Status

Throughout the extreme black swan event, price feed systems from oracles like Chainlink maintained highly normal and stable operations from start to finish. As of UTC 00:55, Ethereum and Bitcoin prices had cumulatively fallen by approximately 4% since the hack occurred.

The decline in various decentralized governance tokens held by the hacker was even more pronounced: AAVE and LINK dropped by approximately 9%, UNI by 8%, and ARB by 6%. The global freeze implemented this time effectively prevented the hacker from depositing these sell-off-impacted tokens into Aave as collateral to cash out.

Currently, outstanding loan positions on the protocol backed by collateral from the aforementioned tokens remain in healthy operating status. As the hacker's on-chain selling continues, the risk team is closely monitoring potential domino liquidation risks.

Regarding major stablecoins, all assets remained firmly anchored. Aave's native stablecoin GHO hovered around $0.998 prior to the hack. Between UTC 21:49 and 22:07, due to holders redeeming approximately 4.6 million GHO for USDT via the GHO Stability Module (GSM), the price briefly dipped to $0.997 before consistently maintaining within this reasonable fluctuation range.

Subsequent Recovery Roadmap: Dynamic Utilization Monitoring and Phased Unfreeze Plan

The overall on-chain situation continues to evolve dynamically. The risk team will maintain 24/7 monitoring of the hacker's wallet cluster and affected asset price feed channels, promptly notifying the community as soon as new developments arise.

Until the hacker's stolen funds completely cease movements and Binance officially achieves clearer, substantial progress in containing the vulnerability and limiting losses, the relevant Aave lending markets will remain frozen.

Thereafter, we will closely collaborate with Aave Labs and other ecosystem service providers to steadily advance a phased and orderly unfreeze plan.

It must be objectively noted that prolonged market freezing also structurally impacts capital utilization within the pools. Since frozen reserve pools no longer accept new deposits, independent withdrawal actions by large lenders will drive up pool utilization rates and push borrowing interest rates higher. Only active repayment by borrowers can bring interest rates back down.

We are conducting rigorous monitoring of real-time utilization changes across all frozen reserve pools and will thereby prudently evaluate the specific prioritization sequence for subsequent batch unfreezing.