Binance estimates incident impact at $6.3 billion as Aave gradually unfreezes markets
Key Facts
Binance estimated the incident’s total impact at about $6.3 billion. In an update dated October 30, Aave said it had begun unfreezing the reserves it had paused, while collateral restrictions remained in place for nine assets. This corrects descriptions of the incident as a confirmed theft of that amount: the figure is an estimate of the total impact announced by the company, which also said it would cover the losses with funds from its SAFU fund and its own resources. Binance said about $3 billion in assets had been frozen on-chain in cooperation with blockchain industry partners. At Aave, functions in the markets that had been paused resumed in stages, but this did not restore the previous collateral terms for every asset. The company said it had found no evidence of wallet keys being compromised and would publish a proof-of-reserves update after remediation was complete.
The incident’s connection to Aave began hours before the freeze measures, when a wallet in the attacker’s group deposited 60 million USDT into the Aave V3 Ethereum Core market between 20:58 and 21:01 UTC on October 29. According to the risk report published by Aave, the wallet borrowed 19,762 WETH during the same period, valued at about $44.6 million at the time. This was activity in a lending market, not evidence that funds of this size were withdrawn from Aave as a result of a platform breach. After tracing the position across networks and versions, Aave said the attacker had one position backed by USDT, worth $59.9 million against debt of $43.8 million. It described the position as overcollateralized and subject to normal liquidation, adding that it did not put protocol suppliers at risk.
The freeze covered 175 reserves in Aave V3 across 16 networks and 117 reserves in V4 across four networks. The measure excluded the Horizon market for tokenized real-world assets, which remained open and was not among the frozen markets. Aave said the purpose of the freeze was to prevent new deposit or borrowing positions while it assessed the risks, while keeping repayment, withdrawal and liquidation available. Liquidations continued during the freeze, and the attacker’s position remained subject to them as usual. But freezing the reserves prevented users from adding new collateral, so repaying debt was the only way to raise the position’s health factor during that period.
On October 30, Aave said it had unfrozen the V3 reserves it had paused and had begun unfreezing V4 in stages; this did not include restoring all assets to their previous collateral terms. The protocol kept the collateral factor at zero for nine assets: USDT, USDC, USDT0, POL, WAVAX, sAVAX, XAUt, PAXG and OP, including wrapped and bridged versions where listed. This restriction means using these assets as collateral does not add new borrowing capacity, while deposit, withdrawal, borrowing and repayment functions remain available. Aave said the freeze decision could be reversed by the guardian; reducing borrowing limits would have required a governance vote and about five days to restore the limits. It added that it would assess the conditions needed to return the collateral factor for these assets to previous levels.
Binance said its initial investigation indicated a possible compromise of a DevOps engineer’s laptop, which enabled access to a service container and the sending of unauthorized withdrawal transactions. The company later said the investigation had uncovered additional points of compromise, while noting that the full sequence of the attack had not yet been determined. Binance also said the attackers exploited the EIP-7702 account delegation feature to take control of a hot wallet without going through the usual approval procedures, and used a mechanism to erase evidence. In the broader context of risks facing cryptocurrency platforms, Bybit suffered a breach in February 2025 that resulted in losses of $1.5 billion; the FBI attributed the incident to North Korea and the TraderTraitor group. TRM Labs said, according to AP’s report of a post by the firm, that it attributed the Binance attack to the North Korea-linked TraderTraitor unit, citing the attack’s characteristics and similarities to previous attacks, with what it described as high confidence.
Market moves showed cryptocurrency prices declining on Thursday and Friday. AP said Bitcoin fell 3.2% on Thursday evening to below $79,000, while Reuters reported that the cryptocurrency later hit a six-week low of $76,368 before the market stabilized. Ether fell more than 3% to a two-month low of $2,178, Reuters reported. In its assessment of the incident’s impact on assets linked to the Aave platform, the risk report said that by 00:55 UTC on October 30, ETH and BTC were down about 4% since the outgoing transfers. It added that AAVE and LINK were each down about 9%, UNI about 8% and ARB about 6%.
The asset freezes coincided with action by stablecoin issuers: Tether said it had frozen about $1.57 billion in assets linked to the incident, while Circle froze more than $800 million, according to Reuters. Binance said it expected withdrawal services to resume within 48 hours of its update published on Friday, October 30. The company also targeted restoring withdrawals on Sunday and publishing an initial proof-of-reserves update before issuing a full report on Monday, according to CoinDesk, citing the company’s chief executive. Binance said it was working with law enforcement, blockchain investigators and token issuers to recover the assets. For Aave, the company said it would continue monitoring the attacker’s wallets, affected reserves and Chainlink price feeds, and would announce in its governance forum the conditions for returning the collateral factor for the nine assets to previous levels.