Aave Freezes Avalanche Lending Markets as Binance Outflow Estimates Range From $2.8 Billion to Over $5 Billion

Since Binance hot wallets began draining at about 20:24 UTC on Oct. 29, the story has moved from a single large transfer to a multi-chain chase, with a DeFi lender, two stablecoin issuers and the suspected attacker all making moves within hours.

Aave locks down Avalanche

Aave has frozen its lending markets on Avalanche to keep the suspected hacker from using stolen funds as collateral. Roughly 1.81 million AVAX and 8.4 million USDT have been linked to the incident on that chain.

The logic is simple. Deposit stolen AVAX into a lending pool, borrow other assets against it, and walk away with clean liquidity. Aave's stated concerns are tainted collateral and misuse of borrowed funds.

Aave has reported no direct losses from this incident. It froze its rsETH markets in April during the KelpDAO exploit, when about $290 million in unbacked assets were being used as collateral.

The freeze has a cost for ordinary Avalanche users who wanted to supply or borrow on the protocol while the markets are locked. Aave has not said when they will reopen.

The numbers keep changing

No one has a settled figure for what left Binance. Estimates differ sharply:

• About $2.8 billion in a single Ethereum transaction, per the CryptoTicker timeline.
• About $3.3 billion across multiple chains, per initial assessments.
• More than $5 billion, per data from the on-chain platform Arkham.
• About $5.64 billion across six chains, per one on-chain tracking breakdown: roughly $3.53 billion on Ethereum, $1.45 billion on Bitcoin and $627.83 million on Tron, with about $38.42 million on Arbitrum, Optimism and Base. That list covers 70 assets.

These are on-chain estimates. Binance has not published a loss figure.

Freezes and the exchange's position

Tether CEO Paolo Ardoino said the company froze more than $1.567 billion in USDT tied to the incident. Circle CEO Jeremy Allaire said Circle froze more than $800 million in USDC in coordination with law enforcement. Together that is more than $2.3 billion.

Binance said in a social media post Thursday that its teams are "aware of reports of a potential security issue and are actively investigating." It added: "User funds are completely safe." It promised updates through official Binance channels.

Founder and former CEO Changpeng Zhao went further, saying it "does look like a hack" and that he expects all user funds to be fully covered.

Binance has not said how the wallets were compromised, how much it lost, or how a shortfall would be covered if the freezes do not recover enough.

The attacker starts selling

On-chain records show wallets believed to be under the attacker's control swapping tokens that issuers cannot freeze. Transactions on Uniswap V2, V3 and V4 included UNI and PEPE. The initial breakdown tracked about $53.29 million in UNI and $38.91 million in PEPE.

One PEPE transaction moved about 68.01 billion tokens into a liquidity pool in exchange for roughly 135.34 WETH. That was worth about $307,700 in the screenshot shared.

A separate on-chain analysis said a wallet labeled "Binance 14" authorized an attacker-controlled smart contract through EIP-7702, and that the authorization was ongoing. The same analysis said 200 million USDT was deposited into a wallet and, six blocks later, 200.4 million USDT, 369.8 ETH and about 12 other tokens moved to another address. The USDT was blocked because the recipient address was frozen. The ETH and other tokens were not affected.

An address that initiated the first transfers was funded through Tornado Cash, according to Yahoo Finance's reading of blockchain data. No one has said who controls the receiving addresses.

An on-chain wallet suspected of being linked to the attacker holds $47.3 million in UNI, its largest altcoin position, along with ENA, PEPE, LINK and AAVE, according to on-chain analysis.

Market damage

Bitcoin slid from $80,327 to $78,763 in the hour after the first transfer, and was at $78,783 by 22:15 UTC. BNB was down 6.8% over 24 hours at that point. About $628 million in leveraged positions were liquidated in one hour, mostly longs.

Solana fell below $100 even though no SOL was reported stolen. The sell-off hit it through its trading pairs.

Asia opens for trading on Friday, Oct. 30. Whether the market stabilizes depends on what Binance discloses about the breach and whether more stolen assets reach exchanges before the issuers can freeze them.