Aave reopens after the Binance hack: nine assets stay at zero LTV, and Jupiter Lend is still short of cash

Update, 30 October 2026, 18:20 UTC: Aave said at 13:57 UTC that all its V3 and V4 markets are unfrozen, while nine assets stay at an LTV of 0 and cannot back new loans. LlamaRisk’s plan on the Aave forum has four waves and marks only the second as executed, but Ethereum transactions we read show the Core market unfrozen at 12:26 UTC and LTV restored on 13 reserves at 13:37 UTC. Aave’s own API showed V4 open at 17:50 UTC, except two reserves on its Kelp spoke. Idle USDC on Core is back to about $89 million, while Jupiter Lend remains almost dry.

Aave has unfrozen its V3 and V4 markets, about 16 hours after the freeze that followed the Binance hack began shutting 292 lending reserves to new deposits and new loans: 175 on Aave V3 across 16 networks and 117 on Aave V4 across four. Nine assets, USDT and USDC among them, stay at zero LTV, so they cannot back new loans. Cash has started to come back. At 17:48 UTC on Friday 30 October, Ethereum Core held about $89.0 million of idle USDC against $2.11 billion supplied and about $62.7 million of idle USDT against $2.52 billion, up from about $95,000 and $1,900 at 11:59 UTC.

Aave confirmed the reopening in a post on X at 13:57 UTC. Risk manager LlamaRisk had set out the plan minutes earlier in its thread on the Aave governance forum. The smaller borrow caps it recommended are still in place on the Ethereum reserves we read, and it says the temporary cut to the rate ceiling will be reviewed once markets are back to normal.

The lockout has not ended everywhere. On Solana, Jupiter Lend said on Friday morning that a liquidity crunch was holding up withdrawals, and its API showed no more than about 2,100 USDC available around 17:51 UTC against about 413.7 million in the vault. Kamino paused borrowing in one market. Unit, which moves assets onto Hyperliquid, said on Friday morning that every deposit and withdrawal now carries a processing delay. We found no update from any of the three after that.

The sums the attacker touched in DeFi are small next to the roughly $6.3 billion total impact Binance estimates. One exploiter-linked wallet supplied 60 million USDT to Aave and borrowed 19,762 WETH. No loss to depositors has been reported at any of these protocols. The cost so far is access: some depositors still wait for their money and borrowers have paid more.

Which of Aave’s four unfreeze waves have executed

The two official accounts do not read the same. Aave’s post says: “All markets are now unfrozen across Aave V3 and V4.” LlamaRisk’s update, published at 13:51 UTC, says the guardians “will execute this plan in four waves” and marks only the second as done. It had not been edited when we read it again at about 17:50 UTC. The chain settles part of this: on Ethereum Core the work had been done before that post appeared.

On Core, WETH and WBTC are back at 81%, staking means depositing a proof of stake coin with a protocol that stakes it for you and issues a transferable token (such as Lido stETH or rETH) representing the deposit plus rewards, which you can use or sell while the coins stay staked.">wstETH at 79% and AAVE at 69%. USDC and USDT, both at 75% before the freeze, stayed at 0. The two V4 reserves still frozen are WETH and rsETH on the Kelp spoke, and we do not know whether they were part of Thursday’s 117.

Two gaps remain. Outside Core we cannot say how far LTV has been restored: Aave’s API at 17:48 UTC showed 67 of 314 V3 reserves with an LTV above 0, and WETH at 0 on Ink and Mantle, unfrozen and outside the nine, which may or may not predate the incident. The same API lists 125 V3 reserves as frozen. Many are old listings, such as expired Pendle tokens, or sit on networks outside Thursday’s 16, such as Scroll and zkSync, and none of the 47 reserves we traced on Core, Gnosis and Plasma is among them. We did not trace the rest.

Nine assets stay at zero LTV, with different rules on V3 and V4

Aave’s second post names them: USDT, USDC, USDT0, POL, WAVAX, sAVAX, XAUt, PAXG and OP. They “will temporarily remain at an LTV of 0 so they can’t be used as collateral for new borrows.” LlamaRisk adds that the rule covers bridged and wrapped versions on every market where they are listed, and E-Mode on V3, and describes them as the assets held across the exploiter’s address cluster.

The limit is narrow. Supplying, withdrawing, borrowing and repaying these assets works as normal, LlamaRisk says; they only stop adding new borrowing power. On V3, existing positions keep their liquidation thresholds, so health factors do not change. On V4, existing positions stay on their current collateral settings until a new borrow, a collateral withdrawal or a collateral toggle moves them to the factor of 0.

LlamaRisk’s first post said “Markets will stay frozen until the exploiter’s funds stop moving.” Its update does not say that happened; it says the team keeps monitoring those wallets. Neither Aave nor LlamaRisk has explained why the freeze ended before that condition was declared met, and keeping the exploiter’s assets at zero LTV is the only link we can see. Aave says its contracts were unaffected and positions “remained fully collateralized”, and founder Stani Kulechov said all positions stayed overcollateralised, according to Cointelegraph. LlamaRisk promises to publish the conditions for restoring LTV on the nine assets in the same thread, with no date.

What the reopening changes for depositors and borrowers

During the freeze LlamaRisk spelled out the rules in one line: “Users can still repay and withdraw, and liquidations keep running.” Supplying and borrowing were off on every frozen reserve, and that included adding collateral to an existing loan. Both are back, within the lower borrow caps and the nine-asset limit.

Depositors can move funds into Aave again. A deposit of USDC or USDT adds no new borrowing power for now, though it can still be supplied and withdrawn as usual. Getting money out still depends on the cash in the reserve, as the figures below show.

A loan normally has two defences against liquidation: more collateral or less debt. The freeze removed the first until markets reopened, leaving repayment as the only way to raise a health factor. Liquidations never stopped, and a falling price or a rising debt can still push a position under the line. LlamaRisk said on Friday morning that oracle price feeds had worked normally throughout.

Not everything was frozen. Horizon, the permissioned market for real-world assets, stayed open because the exploiter cannot use its collateral, and no market was paused. The frozen V3 list ran from Ethereum Core and Prime through Arbitrum, Avalanche, Base and BNB Chain to newer networks such as Monad, MegaETH and Plasma. On V4 it covered the main Ethereum spokes, the Avalanche spokes, the Base tokenized-equities spoke and the Arc spokes.

The guardian multisigs signed the freezes between 21:42 and 23:04 UTC on Thursday, a span of about 80 minutes, starting some 40 minutes after the exploiter’s last move on Aave. LlamaRisk says it joined Aave Labs, TokenLogic and Certora in a war room within 10 minutes of the first reports. It chose a freeze because the guardian can reverse one, while cutting caps instead “would have needed a governance vote and about five days to restore.”

Why one $60 million deposit worried a lending pool

Between 20:58 and 21:01 UTC on Thursday, a wallet in the exploiter’s cluster supplied 60 million USDT to Aave V3 Ethereum Core and borrowed 19,762 WETH, worth about $44.6 million at the time. LlamaRisk’s post, last updated at 01:00 UTC on Friday, calls it the exploiter’s only position on Aave, valued at $59.9 million of collateral against $43.8 million of debt, and says no exploiter wallet had touched Aave since 21:01 UTC. On that position it is blunt: “It does not put Aave suppliers at risk.”

So why shut 292 reserves over one over-collateralised loan? Because the exploiter could swap stolen funds into any listed asset, LlamaRisk says, so freezing only the stolen tokens would have left other ways in. Aave asks no one for permission: this wallet posted its tokens and left with liquid ETH in about three minutes, without selling anything and without an exchange in the way.

A big enough deposit can also borrow out the cash that honest depositors expect to withdraw. Selling stolen governance tokens lowers their value as collateral: LlamaRisk said the exploiter was selling UNI, LINK and AAVE for ETH on decentralised exchanges, with AAVE and LINK down about 9% and UNI about 8% by 00:55 UTC. On the forum, user AlanWestbrook sketched a worse case, a hacker depositing billions in stolen USDT and Tether blacklisting the contract that holds Aave’s pooled USDT. Another user, submitblock, replied that he knows of no case of Circle or Tether doing that to a protocol address.

LlamaRisk also said the exploiter still held large ETH, stablecoin and governance-token balances, spread across more than 20 new wallets. That was its reason for wanting less open borrowing room before anything reopened.

Cash is returning to the pool, but USDC and USDT are still mostly lent out

A lending smart contract holding reserves of two or more tokens, supplied by users, that a decentralized exchange uses to execute trades automatically at a price set by a formula.">pool pays withdrawals from money that is not lent out, a point our guide to crypto lending and borrowing covers in detail. LlamaRisk described the bind in its first post: frozen reserves take no new supply, “so withdrawals by large suppliers raise utilisation and borrow rates, and only repayments pull them back down.”

We read four reserves on the Ethereum Core contract ourselves, between 11:57 and 11:59 UTC during the freeze and again at about 17:48 UTC after it. These are snapshots of the token balances held by Aave’s aToken contracts, and the cash figure moves block by block. Aave’s own accounting of what it can pay out was lower at 11:59 UTC: about $62,400 of USDC and $414 of USDT.

During the freeze, depositors in USDC and USDT were earning about 9% a year, and a large withdrawal from either reserve could not have been paid in full until borrowers repaid or liquidations returned cash. USDC cash fell from about $198,000 to $95,000 in the two minutes between our morning readings. That was our reading of how the mechanism works, not a statement from Aave: LlamaRisk has not said any depositor was refused, and we did not read the other networks. Its 00:26 UTC table put Plasma USDT0, Monad USDT0 and Arc USDC at 100% utilisation too.

The evening reading is different. Supplied balances have risen from $2.02 billion to $2.11 billion of USDC and from $2.47 billion to $2.52 billion of USDT since 11:59 UTC, so at least part of the cash is new deposits. Borrow rates on both were 10% at 11:59 UTC. The pools remain tight: utilisation stood at 95.8% on USDC and 97.5% on USDT at 17:48 UTC, so the great majority of deposits still depends on borrowers repaying.

The drain is visible. A second LlamaRisk post, with data from 00:26 UTC, listed $2,140 million of USDC and $2,717 million of USDT on Core, so about $370 million had left those two reserves by 11:59 UTC, in under 12 hours. Withdrawals had already pushed the largest stablecoin reserves to between 92% and 100% utilisation, with borrow rates between 10% and 36% APR and up to 55% at full utilisation on some reserves.

High rates normally pull in new deposits. With supply frozen they cannot, so LlamaRisk argued they mainly swell borrowers’ debt and wear down health factors. It recommended cutting Slope2, the steep part of the rate curve above the kink that Aave moved to 92% on USDT last week, so the rate at full utilisation does not exceed 10% APR.

That 10% is not uniform. The rule applies to reserves with more than $10 million supplied, utilisation near or above the kink and a full-utilisation rate above 10%, and the post’s own tables stop higher in places: frxUSD 19%, DAI 20%, mUSD 25%, USDtb 34%. It also reaches WETH on the V4 Ethereum Core Hub and RLUSD on Horizon, which was never frozen. LlamaRisk calls the change temporary and will review the old settings once markets are back to normal.

The cut appears to have gone through on Core. At 100% utilisation at 11:59 UTC, USDC and USDT were charging 10% on-chain, where the old curve gave 14.5%. We did not check other networks or V4.

GHO, Aave’s own stablecoin, moved only slightly, from about $0.998 to $0.997. About 4.6 million GHO were redeemed for USDT through its stability module between 21:49 and 22:07 UTC on Thursday.

The borrow caps now apply, and about $3.7 billion of room is gone

A third LlamaRisk post, with data from 08:52 UTC on Friday, set the terms of the reopening. It removes about $3.7 billion of unused borrow capacity on V3 and about $130 million on V4. Frozen reserves ignore caps, so the cuts only began to bite on reopening, the moment they were designed for. The post warned that with the old headroom “a single actor” could build a large position “in the first blocks after the unfreeze.”

The formula sets each new cap at the larger of the pre-exploit or current borrowed amount, plus 2%. It applies where more than $10 million was borrowed before the exploit and more than $10 million of capacity remained. LlamaRisk wrote that it “will move forward and implement” the changes through the Risk Steward process, and on the seven Ethereum reserves we read they are live, Core USDC at 2.27 billion and Core USDT at 2.56 billion among them. The Core GHO cap, which the GHO Stewards handle, stood at 150 million at 11:59 UTC and at 105 million at 17:46 UTC.

That route sits awkwardly with Thursday’s explanation of the freeze, when LlamaRisk cited a governance vote and about five days. The new post says caps can rise again through the regular Risk Steward process after a 36-hour cooldown per update. It does not explain how the two timelines fit, and we found no later post that does.

The Ethereum lines are confirmed on-chain; those for Monad, Avalanche and Gnosis are LlamaRisk’s recommended figures, which we did not read on those networks. The two euro stablecoin lines matter for European users: there is now less room to borrow in euros on those reserves.

Jupiter Lend has about $414 million of USDC claims and almost no cash on hand

Jupiter’s position shifted over the night. At 23:32 UTC on Thursday its Jupiter Earn account said Jupiter Lend “has not been affected”. At 09:01 UTC on Friday the same account wrote that “there is currently a liquidity crunch impacting withdrawals,” and that withdrawals would process again as users deposit or repay. Thirteen minutes later it answered the obvious objection: “Both are true. We have zero exposure to Binance, no funds are held there and nothing was lost.” The 09:01 UTC post also said “Liquidity will soon be available again” and “all funds are safe,” with no date. We found nothing from Jupiter on the vault readings below.

The numbers have barely recovered since. Solana Compass read Jupiter’s API at 09:18 UTC and found about 419.6 million USDC supplied, with about 7,900 withdrawable at once; The Defiant, at a different moment, gave 3.35 USDC against 418.5 million of claims. We read the same API at 11:56 UTC and saw about 701,000 USDC available, then 0.002 USDC at 11:59 UTC against about 417.8 million in the vault. At 17:50 and 17:51 UTC its withdrawable field showed about 55, then about 2,088 USDC, against about 413.7 million. Figures that low could be a data fault, so we read the Solana account that holds the USDC: it agrees, at 54 USDC at 17:50:55 UTC, 2,088 at 17:51:41 UTC, 18 at 17:51:56 UTC and about 850 at 18:08 UTC, the last matching the API to the cent. Cash that appears is often taken within seconds.

The JupUSD vault showed about 421,000 available of roughly 44.5 million at 17:51 UTC. SOL was in better shape, with about 52,240 of roughly 208,950 SOL able to leave.

Two limits are at work. Jupiter’s documentation describes a ceiling on how fast money can leave: usually up to 25% of supply per six-hour window, up to 50% on some vaults. The API shows 25% on SOL, which is where that vault sits, and 50% on USDC and JupUSD. The USDC problem is the plainer one, the same as on Aave: the money has been lent out, and the documentation warns that depositors “may need to wait for repayments or new deposits to withdraw in full.” Unlike a frozen Aave reserve, Jupiter’s vault can still refill from new deposits, and the API showed USDC paying about 14% a year at 11:59 UTC.

Solana Compass counted wallets signing Jupiter Lend transactions at 49 to 73 an hour in the six hours before 20:00 UTC, 107 to 165 in the six hours after, with the peak of 165 around midnight, and back to 66 to 91 from 03:00 UTC. Jupiter had not published a timeline for clearing queued withdrawals at the time of that report (09:28 UTC), and we saw none in its posts that we read. DefiLlama listed Jupiter Lend at about $898 million of total value locked at about 18:10 UTC.

Kamino took a narrower step. At 22:03 UTC on Thursday it said it was “currently unaffected by the ongoing Binance situation” and had paused borrowing in its SOL/BTC market “out of an abundance of caution.” Co-founder Marius added at 22:43 UTC that the team saw “no exposure to the hack and no backing issues,” and Solana Compass reports he also said the attacker’s SOL wallet was blocked within five minutes of being identified and “We expect to resume shortly.” By 09:22 UTC on Friday, Solana Compass reported no resumption. Neither post describes any limit on deposits or withdrawals.

Unit delays every transfer to slow stolen funds

Unit, the layer that brings assets such as BTC, ETH and SOL to Hyperliquid, said at 09:21 UTC on Friday that “every Unit deposit and withdrawal is subject to a processing delay.” It calls the change a protocol upgrade “to deter attempts to move stolen assets through the protocol” and to give intelligence on the incident more time to surface. It gives no length: the delay “may change as the incident response develops.” Transfers that fail its Guardian screening may not complete, it adds, and it acknowledges the disruption to users. We found nothing from Hyperliquid on whether trading is affected.

How much is stuck, as far as anyone can say

There is no single total, and the headline numbers measure different things. Aave’s rules now limit only the nine assets’ use as new collateral, but most of its Core dollar deposits are lent out. Jupiter’s figure is the size of the queue risk, not a loss.

DefiLlama’s last point for Aave V3, at 16:44 UTC on Friday, is $14.55 billion, against $14.97 billion at 00:00 UTC on Friday and $16.52 billion at 00:00 UTC on Thursday, about 20 hours before the drain. That is about $2 billion, or 12%, and most of it was gone by midnight. Its 10:33 UTC point was $14.51 billion, so the figure has barely moved since. The figure also includes price moves: ETH was near $2,240 at around 17:45 UTC, down 4.2% over 24 hours.

April’s run on Aave was far larger

Aave has been here before. In April 2026 the attacker behind a roughly $300 million hack of KelpDAO’s rsETH posted about $200 million of the token on Aave and supported about $236 million of borrowing, PeckShield said, according to Gulf News. DefiLlama then showed about $9 billion of net outflows in the following days, leaving Aave’s total value locked down by more than a third at about $17.5 billion.

The difference this time is the collateral. In April it was a token whose backing had been broken. This time it is USDT, and the position is over-collateralised. Aave’s fall so far is under a quarter of April’s outflow, though the two figures are not measured the same way, and the comparison does not prove the freeze held anything back.

Aave’s forum is already arguing over the fix

The thread under LlamaRisk’s post shows users split, and these are their views rather than Aave’s. One user, submitblock, calls the freeze “probably an overreaction” to a $60 million deposit. Another, willray, says Aave has no flow-limit mechanism like the one on Fluid and that the team took no such measures after the Kelp incident.

Two ideas are on the table in that thread. AlanWestbrook wants borrowing power from deposits above $10 million released in stages over 96 hours, and Zodd suggests a market-wide borrow speed limit, for example $10 million of WETH per 10 minutes. Both would slow an attacker and also ordinary large users. Another poster, davgit, asks whether Chaos Labs, which left Aave in April, should come back. We saw no formal governance proposal on any of these ideas at 17:50 UTC, and LlamaRisk’s post of 13:51 UTC was the last in the thread.

What is still unknown, and what to watch

• LlamaRisk says it will publish in the forum thread the conditions for restoring LTV on the nine assets, and it keeps watching the exploiter’s wallets.
• Idle USDC and USDT on Core will show whether cash keeps coming back faster than depositors take it.
• LlamaRisk also plans to review the temporary rate ceiling once markets are back to normal, which would change what borrowers pay.
• Aave has not published the execution times for V4 or the other V3 networks, and we have not read them.
• Jupiter’s withdrawable USDC is a public number, and any timeline from the team would be the first.
• Unit has not said how long its delay is or when it will end.

One detail on the exploiter’s loan is new. LlamaRisk’s first post identifies the wallet behind the $60 million deposit as one in the exploiter’s cluster, and Tether’s USDT contract recorded a blacklist entry for it at 21:02:47 UTC on Thursday, about two minutes after its last move on Aave. The wallet was still listed when we read the contract at about 17:50 UTC, while Aave’s aUSDT contract, which holds the pool’s USDT, was not. The listing therefore does not cover the deposit itself: data firm Bitquery wrote that “Tether cannot freeze that USDT, because Aave holds it.” We have read no statement on the entry from Tether or Aave. At 17:46 UTC Aave’s contract still counted $59.9 million of collateral against $44.2 million of debt on that wallet, a health factor of about 1.06. The debt is in WETH and the collateral in USDT, so by our own arithmetic, at a 78% liquidation threshold, ETH would have to rise by a little under 6% for that loan to reach the liquidation line.

One practical note on the days ahead. Hacks tend to bring out fake “recovery” and “claim” pages. In what we read, neither Aave nor Jupiter has announced any claim, migration or action that users must take. Depositors who hold positions directly also have no exchange between them and the protocol, and nothing we read extends Binance’s reported pledge to cover losses to anyone using these lending markets.

We last checked the Aave forum, Aave’s Ethereum Core reserves, Aave’s API and Jupiter’s API between 17:46 and 18:10 UTC on 30 October 2026.