When a centralized exchange gets robbed, you'd expect the damage to stay inside the exchange. The Binance hot-wallet incident on October 29 showed how fast it can leak into DeFi instead, and how a lending protocol behaved when it happened.
Here is the sequence, as documented by Aave's risk provider LlamaRisk on the protocol's governance forum and relayed by CoinsCipher.
THE TIMELINE
At 20:24 UTC on October 29, a compromised Binance hot wallet on Ethereum sent roughly 63 tokens and 167,464 ETH to a single address in one transaction. The same address then received a further 28,006 ETH from a second hot wallet.
Between 20:58 and 21:01 UTC, a wallet in the exploiter's cluster supplied $60 million of USDT to Aave V3 Ethereum Core and borrowed 19,762 WETH, worth about $44.6 million at the time. That happened roughly 40 minutes before Aave's guardians froze markets.
Per LlamaRisk, the position is over-collateralized and does not put suppliers at risk, and no exploiter-linked wallet had touched the protocol since 21:01 UTC.
For scale, TRM Labs put the overall theft at about $6.36 billion across ten blockchains, with roughly $2.7 billion frozen and about $2.4 billion still held by the attacker when it analysed the case. Later estimates move around, so treat any single number as a snapshot.
WHY AAVE FROZE EVERYTHING
Aave could have frozen only the assets taken from Binance. It didn't. Its guardian multisigs froze 175 reserves on V3 across 16 networks and 117 reserves on V4 across four networks. The reasoning, as reported: the exploiter could otherwise swap stolen funds into any listed asset and use that one instead.
A freeze is narrower than a shutdown. Per the reporting, withdrawals, repayments and liquidations kept working, while new supply and new borrowing were blocked.
THE SIDE EFFECT NOBODY LIKES
Freezing a lending market creates its own problem. If people can withdraw but nobody can supply, utilization rises, and in Aave's rate model, borrow rates spike once utilization passes the optimal point. That steep section is called Slope2.
So on October 30 the Risk Stewards temporarily cut Slope2 to cap variable borrow rates on stablecoin and WETH reserves at 10% APR. They also cut borrow and draw caps on the largest reserves to roughly 2% above pre-exploit borrowing levels.
On October 31 the stewards recommended restoring Slope2 to pre-incident levels. For USDC and USDT that means back to 10.00%, and for DAI back to 35.00%. LlamaRisk wrote that the affected reserves "are no longer frozen," and that borrow rates at or below the optimal utilization point were never affected. The post does not say when the cap reductions will be reversed, so that remains an open item.
WHAT THE MARKET DID
AAVE traded around $133.79, down about 3.94% over 24 hours at the time of one Nov 2 market report, with the Crypto Fear and Greed Index at 37. Funding was neutral at 0.01%. The same report put Aave's TVL near $16.5 billion on DeFiLlama. Different trackers show slightly different TVL figures, so use these as rough context, not precise measurements. DefiLlama's own overview showed total DeFi TVL near $85 billion, down about 4.8% on the week, with Ethereum down about 10% to roughly $44 billion.
WHAT TO TAKE FROM IT
1. The chain between CeFi and DeFi is short. Stolen funds reached a lending market within about half an hour of the theft, through ordinary supply-and-borrow actions rather than any bug.
2. Over-collateralization did its job. A hostile borrower still had to post more than they took out.
3. Emergency tools cost something. Freezing protects the protocol but squeezes honest users through rate spikes, which is why the unwind took two days of governance posts.
4. Governance speed matters. Risk Stewards can change parameters within pre-approved bounds without a full vote, and that is what allowed same-day moves.
WHAT TO WATCH NEXT
Whether the borrow and draw cap cuts are reversed or ratified, and whether the exploiter-linked WETH position is repaid or liquidated. If more wallets tied to the theft show up on lending markets, more parameter changes are possible.
Some caveats. Several figures here come from secondary reports of forum posts, and the situation is still developing. Always check protocol governance forums and official channels yourself.
If you lend or borrow on-chain, did this change how you size positions or choose markets? Tell me below.
Data: Aave governance forum via CoinsCipher, TRM Labs via edgeX report, DefiLlama. Not financial advice.