# Binance-linked wallet borrowed $44.6 million of ether on Aave 40 minutes before the protocol froze markets

Aave says its contracts were never at risk, but its emergency freeze raised borrowing costs for other users, and on Solana Jupiter Lend's withdrawable USDC has recovered only to about 7% of its assets.

- Published: 2026-11-01T05:46:52.612Z
- Canonical: https://polylog.news/crypto/2026-11-01/binance-linked-wallet-borrowed-44-6-million-of-ether-on-aave
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [crypto.news](https://crypto.news/aave-wasnt-hacked-why-did-its-users-face-restrictions/), [CryptoSlate](https://cryptoslate.com/jupiter-lend-usdc-withdrawal-liquidity-rebounds/), [TechFlow](https://www.techflowpost.com/en-US/article/34992), [Decrypt](https://decrypt.co/382194/binance-hack-exit-ramps-defi-exchange-ethereum)

The Binance attacker used Aave to swap freezable dollars for an asset no issuer can freeze. Between 20:58 and 21:01 UTC, an address in the attacker's wallet cluster [deposited 60 million USDT (Tether's dollar token) into the Aave V3 Ethereum Core market and borrowed 19,762 wrapped ether (WETH)](https://www.techflowpost.com/en-US/article/34992), worth about $44.6 million. Aave's first emergency freeze came at 21:42, roughly 40 minutes later. Tether can freeze USDT at the token contract, so the attacker posted it as collateral and left with ether, which Tether cannot reach ([Altcoin Buzz](https://www.altcoinbuzz.io/binance-hack-aave-usdt-freeze-ethereum)).

Aave was not hacked. It said its contracts were unaffected and that positions stayed fully collateralized ([crypto.news](https://crypto.news/aave-market-freezes-binance-hacker-usdt-eth-loan/)). The defensive freeze still cost other users. Halting new deposits while lenders withdrew [pushed up borrowing costs](https://crypto.news/aave-wasnt-hacked-why-did-its-users-face-restrictions/) and reopened the argument over how much disruption emergency powers should impose on people who did nothing wrong. Aave has since reopened its V3 and V4 markets, but nine assets still cannot serve as collateral for new borrowing. [Decrypt](https://decrypt.co/382194/binance-hack-exit-ramps-defi-exchange-ethereum) reports that other DeFi venues, including Kamino on Solana, also paused markets as the attacker looked for places to convert funds.

Solana lending liquidity is thin as well. CryptoSlate reports that available USDC on Jupiter Lend [rebounded from near zero to about 29 million](https://cryptoslate.com/jupiter-lend-usdc-withdrawal-liquidity-rebounds/), roughly 7% of reported total assets, in an October 31 reading. The sources do not show that the Binance theft caused Jupiter's shortage. They do show that a depositor on a fully used pool cannot withdraw until borrowers repay or new deposits arrive.

The pattern repeats April's KelpDAO exploit. Attackers then posted stolen rsETH on Aave and borrowed against it. Stablecoin borrowing rates [jumped from roughly 3.5% to 14% within 48 hours](https://decrypt.co/364849/kelp-dao-exploit-aave-liquidity-crunch-6-2-billion-withdrawal-panic), and trapped depositors borrowed about $300 million against their own locked deposits to get cash out ([CoinDesk](https://www.coindesk.com/markets/2026/04/20/a-usd300m-borrowing-spike-on-aave-signals-liquidity-crunch-after-exploit)).

## What this means

Large lending pools now serve two unintended roles in thefts. They let attackers convert freezable stablecoins into ether, and they push the cost of defensive freezes onto ordinary depositors through rate spikes and blocked withdrawals. The people exposed are stablecoin lenders on Aave and Solana money markets, who carry the liquidity risk whenever governance activates an emergency freeze. Aave's interest is to show it can act quickly without losses. Its depositors want withdrawals that are never blocked, and the two goals conflict. KelpDAO in April is the precedent. Rates spiked, liquidity returned within weeks, and governance added more emergency powers. The market treats "not hacked" as "not affected," and both episodes show that view is wrong. The likelier outcome is that within months Aave and its peers formalize faster freeze triggers, possibly linked to blocklists or analytics alerts. That would cut the 40-minute window but add more governance discretion over which deposits people can use. This read depends on no attacker loss reaching Aave's balance sheet. A bad-debt event would push the debate toward stricter collateral limits.

## What to watch

- Whether Aave governance proposes automatic freezes triggered by external blocklists. That would cut response time but give analytics firms indirect control over the protocol.
- Whether Tether moves to freeze the 60 million USDT held as collateral inside Aave, which would test how the protocol accounts for collateral that an issuer has frozen.
- How quickly Jupiter Lend's available USDC rises from about 7% of assets, since a slow recovery means depositors stay locked in.