Key Takeaways
- Aave froze 292 reserves after attackers drained over 195,000 ETH from Binance wallets.
- Bitcoin plunged to $76,320 as Binance confirmed freezing $3 billion in stolen assets.
- Binance pledged full reimbursement and aims to resume withdrawals within its 45-hour timeline.
Binance Exploit Drains 195,000 ETH Across Multiple Blockchains
Decentralized finance (DeFi) lending protocol Aave froze lending markets across 16 blockchain networks Thursday following a major security breach involving Binance hot wallets, in which attackers drained more than 195,000 ethereum (ETH) and millions of dollars in altcoins across multiple chains.
According to a statement, the exploit began at 3:24 p.m. EST on Oct. 29, 2026, when an attacker initiated a single transaction transferring 167,464 ETH and 63 other tokens from an Ethereum-based Binance hot wallet to an unidentified address. Minutes later, the same attacker received an additional 28,006 ETH from a second Binance wallet, along with assets transferred across Arbitrum, Optimism and Avalanche. The statement added that the continued inflows, including 444,537 AVAX on Avalanche at 5:04 p.m. EST, indicated that the vulnerability remained active for more than two hours.
Following the initial breach, the attacker dispersed funds across more than 20 wallet addresses and began selling tokens such as Uniswap (UNI), Chainlink (LINK) and Aave (AAVE) for ether on decentralized exchanges (DEXs).
Attacker Deposits $60 Million Into Aave Before Emergency Freeze
Between 3:58 p.m. EST and 4:01 p.m. EST, before protective measures were implemented, a wallet linked to the attacker deposited $60 million in tether (USDT) into Aave V3 Ethereum Core and borrowed 19,762 wrapped ether (WETH), valued at approximately $44.6 million. Security analysts confirmed that the position remains overcollateralized, with $59.9 million in USDT collateral backing $43.8 million in debt. As a result, the position poses no direct insolvency risk to Aave liquidity providers and remains subject to standard liquidation mechanisms.
In response to the exploit, security teams from Aave Labs, Tokenlogic, Certora and partner security providers established a joint emergency response group within 10 minutes of the initial reports to coordinate containment efforts. To prevent the attacker from depositing stolen tokens into other pools, protocol guardians implemented a global freeze rather than selectively pausing individual token reserves or waiting for a five-day community governance vote to lower supply caps.
Guardian multisignature wallets executed emergency freeze actions between 4:42 p.m. EST and 6:04 p.m. EST, halting 175 reserves on Aave V3 across 16 networks and 117 reserves on Aave V4 across four networks.
The freeze affects major networks, including Ethereum, Arbitrum, Avalanche, Base, Optimism, Polygon and BNB Chain. However, the permissioned Horizon real-world asset (RWA) market remains operational, and the team avoided full contract pauses.
“We also track the exploiter in real time. We follow every wallet in its cluster on Ethereum, Arbitrum, Optimism and Avalanche, watch for any interaction with Aave, and monitor the Chainlink price feeds that Aave relies on,” Aave said in a statement.
Under the current restrictions, existing users can repay debts and withdraw collateral, but new deposits and borrowing remain blocked.
Binance Identifies Additional Breach Points
Meanwhile, in a new update, Binance revealed that the security breach was more complex than initially believed, with investigators identifying additional points of compromise beyond a potentially compromised laptop.
“Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach,” Binance said.
The exchange said it was coordinating with law enforcement to investigate the attack and recover affected assets. Binance also confirmed that approximately $3 billion in impacted assets had been frozen through cooperation with its partners.
According to the exchange, the unauthorized outflows stopped after it suspended withdrawal services. Binance said deposits remained unaffected and that it was still on track to resume withdrawals within its previously announced 45-hour timeline.
Binance also pledged to reimburse all losses using its Secure Asset Fund for Users (SAFU) and company funds, assuring customers that their assets remained safe.
“This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it,” Binance said. “We are still gathering the facts, and will share more directly as we have them.”
The exchange added that it would continue providing updates through its official communication channels as investigators verified additional information.
Crypto Markets Slide as Aave Prepares for Staged Recovery
Cryptocurrency markets came under immediate pressure following the exploit, with bitcoin plunging to $76,320 and ether falling to $2,170. Tokens directly sold by the attacker experienced steeper declines, with AAVE and LINK each falling 9%, UNI dropping 8% and Arbitrum (ARB) declining 6%.
Major fiat-backed stablecoins maintained their pegs, although Aave’s GHO stablecoin briefly slipped to $0.997 as users redeemed 4.6 million GHO for USDT through its stability module.
Protocol engineers indicated that markets would remain frozen pending further containment updates from Binance and stabilization of the attacker’s wallet activity. A staged process to lift the restrictions will be evaluated once those conditions are met.
