Aave Reopens Its Lending Markets After the Binance Hack — With Nine Assets Barred as Collateral

Aave, the largest decentralised lending protocol by value locked, reopened its V3 and V4 lending markets on October 30, 2026, after freezing them as a precaution during the Binance security incident — but the reopening comes with a visible scar. Nine assets can no longer be used as collateral for new loans, borrowing capacity was cut by billions, and the week's numbers show just how much value the whole DeFi sector lost while the freeze was on. The protocol itself was not breached, existing positions stayed secure, and the reopening was staged rather than rushed. Still, the terms of the return tell the real story of what the Binance hack did to on-chain credit.

What happened, step by step

The chain started inside the Binance incident. After the attack, a hacker deposited $60 million in stolen USDT into Aave V3 on Ethereum and borrowed about 19,762 WETH, valued at $44.6 million, shortly before markets were frozen. Aave froze deposits and new borrowing at 21:42 UTC on October 29, while withdrawals, repayments and liquidations stayed possible. Risk analysts at LlamaRisk later noted the hacker's position held $59.9 million in assets against $43.8 million in debt — overcollateralised, and posing no risk to other Aave users. That distinction matters: the freeze was precautionary, aimed at stopping further exploitation through the protocol, not a rescue of an insolvent position.

The reopening, confirmed on October 30, restored normal operations for all major markets with one exception. Nine assets — USDT, USDC, USDT0, POL, WAVAX, sAVAX, XAUT, PAXG and OP, along with their wrapped and bridged forms — now carry a zero loan-to-value ratio in Aave V3 and a zero collateral factor in V4. Users can still deposit, borrow, withdraw and repay those assets, but they cannot post them as collateral for new loans. Existing V3 positions are unaffected, and on V4 collateral parameters continue unchanged unless modified or withdrawn by the borrower. In parallel, risk stewards cut unused borrowing capacity by $3.7 billion in V3 and $130 million in V4, and reopened markets in four stages to avoid abrupt liquidity shocks.

The week DeFi just had

Total value locked across DeFi fell 7% over the week to $83.70 billion as of October 30, leaving it 26.7% below its year-to-date baseline, according to TokenPost's snapshot. Ethereum still led chains with $43.00 billion, about 51% of the total, ahead of Bitcoin at $6.02 billion, Base at $5.79 billion, Tron at $5.58 billion and Solana at $5.43 billion. Every tracked category recorded a weekly decline; lending alone held $48.78 billion. At protocol level, Lido ranked first at $21.65 billion, Aave V3 followed at $14.51 billion, and Morpho Blue at $10.46 billion. Aave V3 fell 14.22% on the week, Sky Lending 9.56% and SSV Network 7.48%, while Bitcoin's chain TVL gained 37.93% and Hyperliquid's rose 11.94% — the exceptions that prove how broad the damage was elsewhere.

Those figures frame the reopening honestly. Aave is not returning to the market it left; it is returning to a smaller, more cautious one. The zero-LTV list is the mechanism of that caution: by removing the most hack-tainted collateral types from new borrowing, Aave limits how much fresh leverage can be built on assets whose provenance the market now questions, without punishing existing borrowers by liquidating them. The borrowing-cap cuts do the same job from the other side, shrinking the amount of credit that can be drawn quickly if conditions worsen again.

What this means for DeFi lending

Three lessons stand out. First, DeFi's much-advertised composability cuts both ways: a centralised exchange hack became a DeFi lending event within hours, because stolen funds moved on-chain and into a lending market. Second, the system's defences worked as designed in the narrow sense — overcollateralisation held, no user position was reported at risk from the hacker's loan, and the freeze stopped the attack path. Third, the cost of those defences is real and ongoing: nine major assets are now second-class collateral on the biggest lending protocol, and billions in borrowing capacity are gone until risk stewards restore them. That is a healthier outcome than a bad-debt cascade, but it is not a free one, and borrowers who relied on USDT or USDC as collateral will feel it first.

The wider context should not be lost either. Blockchain investigators at Elliptic put the Binance hack's losses at $6.43 billion — more than four times the $1.46 billion Bybit theft in 2025. When an incident of that scale moves through DeFi, even a protocol that did nothing wrong ends up rewriting its risk parameters. Aave's reopening is therefore best read not as a return to normal, but as a controlled restart under tighter rules. Whether those rules loosen again depends on something no protocol controls: whether the stolen funds keep moving, and whether the market's trust in the affected assets recovers.

FAQ

Did Aave itself get hacked? No. Aave reported its smart contracts were unaffected and user positions remained secure; the freeze was a precaution after stolen Binance funds entered Aave V3.

What did the hacker do on Aave? Deposited $60 million in stolen USDT and borrowed about 19,762 WETH (about $44.6 million) before the freeze; the position was overcollateralised at $59.9 million in assets against $43.8 million in debt.

Which assets can no longer be used as collateral? USDT, USDC, USDT0, POL, WAVAX, sAVAX, XAUT, PAXG and OP, plus wrapped and bridged forms — zero loan-to-value in V3, zero collateral factor in V4. They can still be deposited, borrowed, withdrawn and repaid.

How much did DeFi lose in the week? Total value locked fell 7% to $83.70 billion as of October 30, 2026; Aave V3 stood at $14.51 billion, down 14.22% on the week.

Can existing borrowers keep their positions? Yes. Existing V3 positions are unaffected, and V4 collateral parameters continue unless modified or withdrawn by the borrower.

Read more market coverage at https://zimbuck.com/pages/zimbucknews and join the discussion at https://zimbuck.com/groups/zimbuckmarketnews — and see our earlier DeFi coverage at https://zimbuck.com/blogs/517/Solana-DeFi-Stress-Test-Jupiter-Lend-s-418-5M-Pool . This article is market news and general information only, not financial advice.