Aave freezes Avalanche lending markets to block suspected Binance hacker

Aave has frozen its lending markets on Avalanche. The goal is to stop a suspected Binance hacker from using the protocol to borrow funds.

The move follows what appears to be a large unauthorized outflow from Binance hot wallets. Initial assessments suggest around $3.3 billion has moved across multiple chains.

What happened

The suspected drain began at approximately 20:24 UTC on October 29, 2026. Funds were then moved across several blockchains.

A significant chunk landed on Avalanche. Approximately 1.81 million AVAX and 8.4 million USDT have been linked to the incident.

That AVAX stash is the reason Aave acted. A hacker holding that much of a chain’s native token has an obvious move available: deposit it into a lending protocol as collateral, then borrow other assets against it.

By freezing its Avalanche markets, Aave aims to deny the hacker access to that route. The protocol’s stated concern is potentially tainted collateral, along with the misuse of any borrowed funds.

Binance has characterized the events as a hack. The exchange has said user funds are secure, and its investigation is ongoing.

The stablecoin issuers step in

Aave was not the only one reaching for the brakes. Stablecoin issuers Tether and Circle have also frozen assets linked to the suspicious transactions.

Tether froze about $1.5B in related assets. Circle froze about $823M.

Those freezes matter because stablecoins are often the preferred destination for stolen funds. They hold a steady dollar value and move easily between platforms. They also come with a centralized issuer who can blacklist addresses.

Aave has done this before

This is not Aave’s first emergency freeze. In April 2026, the protocol froze its rsETH markets during the KelpDAO exploit.

In that episode, approximately $290 million in unbacked assets were being used as collateral.

Aave has reported no direct losses from that incident or from the current one.

Why the freeze matters

The main stakeholders here are Aave’s liquidity providers, the users who deposit assets for others to borrow. If a hacker had posted stolen AVAX as collateral and borrowed against it, those depositors could have been exposed.

The risk becomes concrete if the collateral is later frozen, seized, or crashes in value. A loan backed by something worthless is a loan that won’t get repaid, and the losses can fall on whoever supplied the borrowed funds.

A precautionary freeze is a blunt tool. It likely inconveniences ordinary Avalanche users who wanted to supply or borrow during the window. Aave appears to have judged that a temporary pause beats potential bad debt.

The decentralization question

Freezes like this tend to reopen an old debate. DeFi pitches itself as permissionless finance, yet in a crisis its biggest players can and do pull the emergency lever.

Tether and Circle freezing funds is consistent with how centralized stablecoins have always worked. Aave pausing markets on a specific chain is a reminder that governance and risk controls still sit behind many decentralized protocols.

What to watch

Several threads remain open. The first is the final scope of the Binance incident, since the $3.3 billion figure comes from initial assessments and could change as the investigation continues.

The second is how long Aave keeps its Avalanche markets frozen. Reopening too early could invite the same risk the freeze was meant to block. Staying shut too long carries a cost for legitimate users.

The third is where the remaining funds go. Approximately 1.81 million AVAX can’t sit idle forever if the goal is to cash out, and every protocol with Avalanche exposure will be watching those wallets closely.

For now, the response has been fast and coordinated. Aave, Tether and Circle each moved to cut off a different escape route.