Aave Reopens All Markets After Binance Hack, Keeps Nine Tokens at Zero LTV

Aave has reopened all of its V3 and V4 markets, ending a freeze that halted $44.6 million of new borrowing after an incident linked to the Binance hack. The reopening was announced on October 30 in a post on X, and founder Stani Kulechov confirmed that markets had been re-enabled. For users of the largest decentralised lending protocol, the move restores normal borrowing and deposit activity, but it comes with an important condition: nine tokens remain at zero loan-to-value, meaning they cannot be used as collateral for new loans.

The freeze itself was a precautionary response to unusual activity that followed the Binance incident. During the freeze, new deposits and new borrows were paused, while withdrawals, repayments and liquidations continued. That distinction matters, because it meant existing users were not locked out of their positions entirely. They could still withdraw funds, repay loans and have positions liquidated under normal rules, even while the protocol stopped taking on new exposure. Aave also said its contracts were unaffected and that positions remained overcollateralised and fully backed throughout the episode.

The scale of the freeze was substantial. One report put the freeze at 292 reserves across 20 networks, while another report described 175 V3 reserves across 16 networks plus 117 V4 reserves across 4 networks. Reports differ slightly on the exact breakdown, and that difference is worth noting rather than smoothing over, because reserve counts can vary with how networks and market versions are counted. What is consistent across reports is that the freeze was broad, covering a large share of Aave’s markets, and that its lifting therefore affects users across many networks at once.

How the attacker used Aave

The trigger for the freeze was a sequence of transactions on October 29 that turned a freezable stablecoin into a different asset inside Aave. According to the report, an attacker wallet deposited 60 million USDT into Aave V3 Ethereum Core between 20:58 and 21:01 UTC on October 29, and borrowed 19,762 WETH, worth approximately $44.6 million. In practical terms, the attacker converted USDT, which can be frozen by its issuer, into WETH, which cannot be frozen in the same way. That conversion is central to understanding why Aave acted: once the borrowed asset left the protocol, the original collateral’s freezability no longer offered the same protection.

The position later stood at approximately $59.9 million in USDT collateral against $43.8 million in debt, and it remained subject to normal liquidation rules. That detail is important because it shows the position was not an unbacked loan. It was overcollateralised, as Aave requires, and it could be liquidated if the value of the collateral fell relative to the debt. The concern was not that Aave’s accounting had failed, but that the source of the collateral and the speed of the manoeuvre created risks that the protocol’s governance and risk managers wanted to contain before allowing new activity to resume.

This was also reported as the second time in 2026 that a North Korea-linked attacker used Aave, following an April episode involving KelpDAO rsETH. That link is presented as reported, not as an independently confirmed finding in this article, and it adds context to why the incident drew wider attention. When a protocol is used more than once in connection with large-scale illicit flows, risk managers, regulators and users all pay closer attention to how quickly safeguards can be applied and how much exposure can build up before controls take effect.

Nine tokens stay at zero LTV

The most consequential part of the reopening for everyday users is the list of nine tokens that remain at zero loan-to-value. Those tokens are USDT, USDC, USDT0, POL, WAVAX, sAVAX, XAUT, PAXG and OP. A zero LTV setting does not mean those assets cannot be held, deposited or withdrawn on Aave. It means they cannot be used as collateral to borrow against for new loans. For a user who previously relied on one of those tokens as collateral, that is a material change, because it limits how they can structure a position until the setting is reviewed.

Zero LTV is a blunt but effective risk tool. By removing borrowing power from an asset, a protocol prevents new leveraged exposure from building on top of it while questions remain about its safety, liquidity or source of funds. It does not unwind existing positions on its own, but it stops the problem from growing. In this case, the inclusion of major stablecoins such as USDT and USDC, alongside gold-backed tokens XAUT and PAXG and other assets, shows that the precaution was applied broadly rather than narrowly to a single token.

Cap cuts before reopening

Before markets reopened, risk manager LlamaRisk proposed cuts to borrowing caps that would reduce how much unused borrowing capacity remained available. The proposal removed approximately $3.7 billion in unused V3 borrowing capacity and $130 million in V4 capacity. It also cut the WETH cap on Core from 2.4 million WETH to 1.79 million WETH. Caps were set at approximately 2% above the larger of pre-incident borrowing and current debt.

Borrowing caps are a core safety mechanism in Aave. They limit how much of an asset can be borrowed from a given market, which in turn limits how large a single position or a coordinated set of positions can become before governance intervenes. Cutting unused capacity does not directly affect most existing borrowers, because it targets headroom that was not being used. It does, however, reduce the room for a rapid, large-scale manoeuvre of the kind seen on October 29, and it gives risk managers more time to react if unusual activity appears again.

Why the freeze and reopening matter for DeFi

Aave’s response illustrates both the strengths and the limits of decentralised lending safeguards. On one hand, the protocol continued to function for withdrawals, repayments and liquidations during the freeze, and positions remained backed. That is a meaningful difference from a centralised platform failure, where users can lose access to funds entirely. On the other hand, the episode showed that even a well-collateralised system can be used as a tool to move illicit funds quickly, and that governance action is still needed to pause activity when a new risk appears.

The incident also raises a broader question for decentralised finance: how should protocols balance openness with protection? Aave is designed to be permissionless, meaning anyone can interact with it without prior approval. That openness is central to its appeal, but it also means that actors with illicit funds can use the same tools as legitimate users. Freezes, cap cuts and zero LTV settings are ways to manage that tension, but they involve judgement calls and governance delays, and they cannot prevent every misuse.

For the wider market, the reopening is likely to be read as a sign of resilience, provided the new limits hold and no further unusual activity emerges. Aave remains a central piece of infrastructure for lending, borrowing and leveraged strategies across many networks, and a prolonged freeze would have had knock-on effects for other protocols that build on it. Restoring markets with tighter controls therefore aims to preserve that role while reducing the specific risk exposed by the Binance-linked transactions.

Implications and risks for users

For current Aave users, the immediate task is to check whether any of their positions rely on the nine zero-LTV tokens as collateral. If they do, they will not be able to use those tokens to support new borrowing until the setting changes, and they should plan accordingly. Users should also review their health factors and liquidation thresholds, because a change in collateral treatment can affect how a position behaves if prices move. As always, positions that were safe before the freeze are not automatically safe under new settings, and the details matter more than the headline that markets have reopened.

For prospective borrowers, the tighter caps mean that very large borrows may be harder to arrange than before, particularly in WETH on Core. That is intentional, but it could affect strategies that relied on deep borrowing capacity. Smaller borrowers and lenders are less likely to notice a direct change, although they may see different rates or available liquidity as the market adjusts to the new limits. Lenders, meanwhile, should note that the protocol’s claim that positions remained fully backed is reassuring, but it does not remove market risk, smart-contract risk or the risk of further governance changes.

There are also risks that remain unresolved. The attacker position is still subject to liquidation, and further movements of related funds could prompt additional action. The reported link to a North Korea-linked actor, if confirmed by investigators, could lead to further scrutiny of how decentralised protocols handle sanctioned funds. And the zero-LTV list itself may change as risk managers learn more, which means users should not assume the current settings are permanent. The reopening is a step toward normality, not a declaration that all questions have been answered.

What did Aave reopen on October 30?

Aave reopened all of its V3 and V4 markets on October 30, ending a freeze that had halted $44.6 million of new borrowing, with founder Stani Kulechov confirming that markets had been re-enabled.

Which tokens remain at zero LTV?

Nine tokens remain at zero LTV and cannot be used as collateral for new loans: USDT, USDC, USDT0, POL, WAVAX, sAVAX, XAUT, PAXG and OP.

Could users withdraw funds during the freeze?

Yes, because during the freeze new deposits and borrows were paused while withdrawals, repayments and liquidations continued, and Aave said contracts were unaffected and positions remained overcollateralised and fully backed.

Why were borrowing caps cut before reopening?

Risk manager LlamaRisk proposed cap cuts, including about $3.7 billion in unused V3 capacity and $130 million in V4 capacity removed and the WETH cap on Core cut from 2.4 million to 1.79 million WETH, to reduce room for rapid large-scale borrowing.

Source: CryptoTimes

Related reading on MM Crypto Analysis Web

• Chainlink Falls 21% in October Despite 18 Days of Exchange Outflows
• Hifi Finance Governance Attack Drains $1 Million in User Collateral
• DeFi Explained for Beginners: Yields, Lending, Risks and Hacks

More in DeFi on MM Crypto Analysis Web.