Aave market freeze ends, but nine assets stay at zero borrowing power

DeFi's largest lender pulled its own emergency brake on Thursday night and released it on Friday afternoon. The Aave market freeze locked new deposits and borrows across every network after a wallet tied to the Binance attacker tried to turn stolen stablecoins into ether, and the reopening came with new limits that stay in place.

What happened

According to risk steward LlamaRisk, one wallet in the exploiter's cluster supplied 60 million USDT to Aave V3 on Ethereum between 20:58 and 21:01 UTC on Thursday and borrowed 19,762 WETH, worth roughly $44.6 million then. The position is overcollateralized and, LlamaRisk said, does not put suppliers at risk.

A war room with Aave Labs, TokenLogic and Certora formed within about 10 minutes of first reports. Guardian multisigs froze 175 reserves on V3 across 16 networks and 117 on V4 across four networks between 21:42 and 23:04 UTC. Withdrawals, repayments and liquidations kept working; the permissioned Horizon real-world-asset market stayed open.

Aave said on X at 13:57 UTC on Friday that all V3 and V4 markets were unfrozen, roughly 15 hours after the pause began. Founder Stani Kulechov wrote that Aave was unaffected and positions stayed overcollateralized.

Why it matters

The unfreeze is not a clean reset. Nine tokens found in the attacker's wallets (USDT and USDC, plus USDT0, POL, WAVAX, sAVAX, XAUt, PAXG and OP) remain at zero loan-to-value on V3 and a zero collateral factor on V4. They can still be supplied, borrowed and repaid, but cannot add new borrowing power.

LlamaRisk also trimmed borrow caps on the largest paths to about 2% above pre-exploit levels, removing about $3.7 billion of unused V3 capacity, and capped stablecoin borrow rates near 10% APR once supplier exits drove utilization into a 92% to 100% band. That is the price of the Aave market freeze: frozen pools take no new supply, so rates spike for borrowers who cannot top up.

Forum critics argued Aave needs flow limits so it is never a hacker's ATM, echoing debates after the X100 governance exploit. The stablecoin side of the story is in our Circle and Tether freeze piece.

The episode also shows how DeFi governance works under stress. LlamaRisk said a freeze was chosen because guardians can reverse it quickly, whereas cutting caps through a normal vote would take about five days to undo. Stablecoins held their pegs throughout; GHO slipped only from about $0.998 to $0.997 as holders redeemed roughly 4.6 million GHO for USDT. Governance tokens the attacker held fell harder, with AAVE and LINK down about 9% in the first hours, the steward said.

What's next

LlamaRisk said it will publish conditions for restoring loan-to-value on the keep-list assets. The full steward write-up sits on the Aave governance forum.

AAVE itself traded near $125.72 late Friday, down 6% in 24 hours, per CoinMarketCap. Forum members are already pushing proposals for borrow-velocity caps; whether any pass will shape how the next Aave market freeze, if any, is handled.