Aave, a platform where people lend and borrow crypto, began reopening some lending markets Friday after tightening borrowing limits and cutting interest-rate settings. The reopening follows a
Aave, a platform where people lend and borrow crypto, began reopening some lending markets Friday after tightening borrowing limits and cutting interest-rate settings.
The reopening follows a freeze on 292 reserves, or pools of individual cryptocurrencies available for lending. Aave imposed the restrictions after money was stolen from Binance, the world's largest crypto exchange.
Records on the blockchain, the public ledger of crypto transactions, show pools reopening from 8:21 a.m. ET on Aave V3 and 8:56 a.m. ET on Aave V4. Those are two versions of the lending system.
Related: I'm with Elon Musk on Binance's hack
Aave is part of decentralized finance, or DeFi: financial services run through computer programs on crypto networks rather than a bank. People supply crypto to shared pools to earn interest; borrowers pay interest to use those funds.
Borrowers must first put up crypto worth more than the loan as security. That security is called collateral, and it can be sold if it no longer provides enough backing for the debt.
Watch Mehab Qureshi, senior editor at TheStreet, decode the Binance hack:
How did hackers drain $6.3 billion from Binance in about 20 minutes (3:39)The LlamaRisk dashboard, which tracks changes to Aave, logs transactions lifting the freeze on V3 pools on at least 14 of the 16 crypto networks affected. Each network is a separate system for recording and processing transactions.
Arbitrum was first at 8:21 a.m. ET, followed by Ethereum Core at 8:26 a.m. The latest V3 entries reviewed, on X Layer, are stamped 8:53 a.m.
V4 entries run from 8:56 to 9:23 a.m. ET. They cover lending markets called spokes, including Main, Gold, Forex, Ethena and Mag-7.
The entry for Prime, another Aave market, matches an Ethereum transaction confirmed at 8:52:11 a.m. ET.
As of the 9:27 a.m. ET check, the Aave posts reviewed did not describe the reopening. The records also did not establish whether every pool had reopened.
Stani Kulechov, founder of Aave Labs, during the DC Blockchain Summit in Washington, DC, US, on Tuesday, March 17, 2026.Getty Images
Before pools reopened, Aave's Risk Steward process, which allows designated teams to adjust risk settings, cut borrowing limits on 27 V3 pools. The dashboard records those changes between 7:11 and 7:49 a.m. ET.
LlamaRisk, a risk adviser to Aave, had recommended limits roughly 2% above borrowing before the hack, or current debt where that was higher. Its plan removes about $3.7 billion of unused borrowing capacity on V3 and $130 million on V4, reducing how much extra crypto users could borrow after reopening.
For example, the limit for USDT on Ethereum Core is now 2.56 billion tokens. USDT is a stablecoin, a cryptocurrency designed to track the U.S. dollar.
LlamaRisk's 4:52 a.m. ET snapshot showed about 2.47 billion USDT already borrowed. That left room for roughly 89 million more tokens in loans.
Several V4 draw caps, which limit borrowing through its credit lines, were cut at 7:17 and 7:33 a.m. ET. These limits restrict new borrowing; they do not force existing borrowers to repay immediately.
The freeze also made some loans more expensive. With new deposits blocked, withdrawals left 92% to 100% of the money supplied to the largest pools already lent out by 8:26 p.m. ET Thursday, LlamaRisk said.
That share is called utilization. Aave raises borrowing rates when a pool is heavily used, so a shrinking supply of available funds can mean a higher interest bill for borrowers.
On the Monad network, Aave V3 borrowing rates reached 20.2% for USDC and 36.1% for mUSD, according to LlamaRisk's table. Both are stablecoins, and the percentages express the cost of borrowing over a year, not charges for a single day.
Risk Steward transactions then lowered Slope2, the setting that makes borrowing rates rise sharply when little money is left in a pool. Those V3 changes ran from 9:52 p.m. Thursday to 4:28 a.m. ET Friday.
Not every change matched the proposal. For GHO, Aave's dollar-linked stablecoin, on the Plasma network, the Slope2 setting fell to 11.5%, rather than the proposed 5.25%. That setting alone is not the interest rate a borrower pays.
LlamaRisk's own table also showed some proposed rates above its 10% goal if all supplied funds were borrowed: 20% for the DAI stablecoin, 34% for the dollar-linked USDtb token and 25% for mUSD on Monad. These figures describe rates at full utilization, not what every borrower was paying.
The reviewed records do not establish current borrowing rates. Those rates change as people deposit, withdraw, borrow and repay, including as pools reopen.
Related: Coinbase CEO wants to kill monthly subscriptions, one article at a time
At 4:24 p.m. ET Thursday, a Binance hot wallet sent 167,464 ether and about 63 other tokens to one address, LlamaRisk said. A hot wallet is an internet-connected account used to move crypto; ether is the cryptocurrency of the Ethereum network.
From 4:58 to 5:01 p.m. ET, an account linked to the attacker supplied $60 million of USDT to Aave V3 Ethereum Core. It then borrowed 19,762 WETH, worth about $44.6 million at the time; WETH is a version of ether used by lending programs.
That happened about 40 minutes before the first freeze. LlamaRisk said no account in the linked group had used Aave since 5:01 p.m. ET Thursday.
In LlamaRisk's snapshot, that loan had $59.9 million of collateral backing $43.8 million of debt. The security was worth more than the debt, and LlamaRisk said the position did not put people who supplied crypto to Aave at risk.
Binance's own announcement puts the hack's impact at about $6.3 billion, with about $3 billion frozen on-chain. Here, frozen means transfers of those assets have been blocked, not that the money has already been returned.
People lending or borrowing in the frozen Aave pools faced the restrictions even if they had never used Binance. The disruption spread because the attacker had used Aave after taking funds from the exchange.
During the freeze, users could repay loans and withdraw available funds, but could not add collateral or take out new loans. Liquidations continued: collateral could still be sold to repay a loan if its backing fell below the required level.
Because users could not add collateral to frozen pools, repaying debt was their way to improve a loan's safety margin. The reviewed records do not say how many borrowers or lenders were affected.
If you follow our market coverage, don’t miss the Roundtable 100. Updated every Friday, it's a power ranking of the 100 most investable tech stocks, including digital assets. Check out the latest RTB 100 rankings at roundtable100.com
Related: Varonis Systems jumps 52 places on the Roundtable 100
