Aave Freeze Follows Exploiter-Linked Borrowing
The Aave freeze followed activity by a wallet linked to the Binance exploiter, which supplied USDT and borrowed WETH on Ethereum Core before restrictions began.
According to LlamaRisk’s incident report, the transactions occurred between 20:58 and 21:01 UTC on October 29—approximately 40 minutes before the first freeze.
Incident detail | LlamaRisk’s reported figures |
|---|---|
USDT supplied | Approximately 60 million |
WETH borrowed | 19,762, worth about $44.6 million when borrowed |
Position at the report’s snapshot | $59.9 million collateral against $43.8 million debt |
V3 scope | 175 reserves across 16 networks |
V4 scope | 117 reserves across four networks |
LlamaRisk described the position as over-collateralised and subject to normal liquidation. Its report, updated at 06:30 IST on October 30, identified it as the exploiter’s only Aave position.
Horizon was excluded because its permissioned collateral could not be used by the exploiter. A staged reopening was planned after clearer containment information and an end to the exploiter’s fund movements.
What the Restrictions Mean for Users
Aave’s application notice describes the restrictions as precautionary and confirms that withdrawals and repayments remain available.
However, an enabled withdrawal function does not guarantee immediate access to every supplied token.
Aave’s withdrawal documentation explains that users can withdraw only the liquidity available in a pool. Assets already borrowed by other users cannot simultaneously be withdrawn by suppliers. Borrowers also need to preserve sufficient collateral when removing assets from their positions.
Liquidations continue during the freeze. Users cannot supply additional collateral to frozen reserves, which removes one usual way of improving a borrowing position.
Aave measures borrowing safety through its health factor. A value below one makes a position eligible for liquidation. The calculation accounts for collateral values, liquidation thresholds and outstanding debt—not simply whether collateral exceeds borrowing in dollar terms.
For a position backed by USDT and owing WETH, an increase in ETH’s price can raise the dollar value of the debt. Interest also increases the amount owed over time. This explains why an initially over-collateralised position still requires monitoring.
Rising Borrowing Costs Become the Next Concern
The follow-up LlamaRisk interest-rate proposal highlights a second consequence of the restrictions.
Supplier withdrawals had pushed major stablecoin reserves to between 92% and 100% utilisation, with variable borrowing rates ranging from 10% to 36% APR at the proposal’s snapshot.
Normally, higher rates can attract fresh deposits. During a freeze, that response is unavailable because new supply is blocked.
LlamaRisk therefore recommended temporarily reducing “Slope2”—the parameter governing how sharply rates rise above a reserve’s optimal utilisation level. The proposal targets a maximum variable borrowing rate of 10% APR at full utilisation for selected reserves.
This is a proposed adjustment, not confirmation that every listed change has been executed. It also does not forgive existing debt or suspend interest.
Bitnxt’s explanation of stablecoin yield provides useful background: lending returns come from borrowers paying for capital. A higher advertised return can therefore reflect tighter liquidity and greater pressure on borrowers.
Bitnxt’s Take: Watch Liquidity Alongside Security
Our assessment is that the practical consequences deserve as much attention as the initial security response.
Restricting new activity can reduce exposure while investigators work. Yet existing borrowers continue facing price movements and interest costs, while suppliers depend on available liquidity.
That creates a difficult balance: reopening too quickly could undermine containment, while prolonged restrictions can make positions harder to manage.
Our earlier coverage of AAVE and WLD whale exchange deposits stressed the importance of separating recorded activity from assumptions about its consequences. That report does not establish any connection between the whale and this incident.
Here, the most useful follow-up evidence will be executed rate changes, reserve-level liquidity and confirmed reopening notices. Those developments will show whether conditions are improving for users more clearly than a general assurance that withdrawals remain enabled.
