Hello everyone,
Binance estimates that its October 29 security incident affected about $6.3 billion, with roughly $3 billion frozen. It says it will cover the losses. The investigation is still underway, so those figures are an initial account of the incident, not a final recovery statement. Binance’s update.
In a later October 30 update, Binance said it had reserved more than $6.34 billion of company funds to replace affected assets: $5 billion already held in the relevant tokens, with the remaining purchases underway. It says the roughly $3 billion frozen is separate from those reserves. This is the company’s funding statement, not proof that every customer can withdraw. Later Binance update.
Aave users have a separate problem to work through. An attacker borrowed against stolen USDT, and Aave’s guardians responded by freezing reserves across V3 and V4. The protocol’s contracts were not the source of the Binance breach. Its response has since moved toward staged reopening, with restrictions on which assets can support new borrowing.
My view: check the actions available in your existing position before looking at today’s yield. A reopened reserve may accept deposits while giving those tokens no new borrowing power. And a withdrawal being allowed does not mean there is enough cash for it to execute.
This edition covers the response, the figures I’d watch before considering a new lending position, five developments elsewhere in crypto and five recent podcast picks.
Sources refreshed October 30, 2026, through 16:59 UTC. Market figures retain their earlier timestamps. Aave’s latest inspected operational update is from 13:49 UTC; current onchain settings were not independently reread. Binance still describes withdrawal reopening as a target.
How the Binance incident reached Aave
According to LlamaRisk’s incident account, the attacker supplied 60 million USDT on Aave V3 Ethereum Core and borrowed about 19,762 WETH, worth roughly $44.6 million at the time. Borrowing gave the attacker ETH exposure while leaving the USDT as collateral in the lending pool.
An issuer can blacklist its stablecoin, while it cannot apply that same blacklist to native ETH. Collateral remaining in the pool is not a reason to dismiss liquidation, liquidity or issuer risk. At 01:00 UTC on October 30, LlamaRisk assessed the attacker’s position as overcollateralized and subject to normal liquidation. That is a dated assessment of the position, not a final loss audit.
The guardians froze 175 V3 reserves across 16 networks and 117 V4 reserves across four networks. These are reserve counts, not 292 separate protocols. LlamaRisk says the permissioned Horizon RWA market was excluded.
The cause of the Binance compromise remains under investigation. Binance initially pointed to a compromised employee laptop; a later company update describes multiple entry points into its infrastructure. 808bits’ onchain analysis describes signed EIP-7702 authorizations used in the Ethereum drain. Those observations do not, by themselves, settle how signing access was obtained or who was responsible.
What reopening changes for Aave users
The initial freeze blocked new deposits and borrowing while leaving withdrawals, repayments and liquidations available. By 13:49 UTC on October 30, LlamaRisk’s next update outlined a staged rollback: reopen reserves, restore collateral borrowing power for most assets and keep restrictions on a selected group.
The update describes four waves and explicitly marks the V4 collateral-configuration change as executed. Its wording does not establish that every reserve has completed every reopening step. Check the version, chain and asset you actually use.
Reopening and restoring borrowing power are separate changes. The announced rules retain zero loan-to-value on V3, or zero collateral factor on V4, for USDT, USDC, USDT0, POL, WAVAX, sAVAX, XAUt, PAXG and OP, including relevant wrapped or bridged forms and V3 eMode. These settings give those assets no new collateral borrowing power; they do not mean the tokens have no market value.
For existing V3 positions, LlamaRisk says liquidation thresholds remain unchanged, so this parameter change does not itself change their health factor. Prices and debt can still move it.
For existing V4 positions, the action matters. LlamaRisk says positions retain their existing collateral configuration until a new borrow, collateral withdrawal or collateral toggle moves them to the new configuration. For the affected assets, that means zero collateral factor. Before changing a position, check the configuration the action would apply, not just the health factor shown beforehand.
LlamaRisk’s October 30, 13:49 UTC update sets out the rollback and collateral restrictions. This excerpt does not establish that every market has completed every wave. Source · Captured 2026-10-30T17:10:38.843181+00:00.
If you supply, check the specific asset’s available liquidity. An allowed withdrawal still needs available cash, and a deposit securing a loan must leave the position within its collateral requirements. Repayments and new supply can replenish cash as the reserve permits. Aave’s withdrawal guidance.
Aave’s withdrawal guide: available pool liquidity limits what suppliers can withdraw. This describes the mechanics, not a live liquidity balance. Source · Captured 2026-10-30T17:10:48.190692+00:00.
I’d check these four things in the actual market I use:
The reserve’s current state and collateral rules. Check the chain, version and asset. An update about one market does not establish that another has reopened or restored borrowing power.
Debt and repayment assets. Know what you owe and whether you can obtain the token needed to repay without relying on a restricted deposit or borrow route.
Available cash and collateral headroom. Both matter to an exit. On V4, also check whether your action changes the collateral configuration.
The route behind a vault or app. A familiar interface can depend on a lending market affected by the response. Check the underlying allocation and current withdrawal terms.
Liquidations were not suspended by the freeze. I would not treat either emergency restrictions or reopening as a grace period for a position close to its liquidation threshold.
I’d wait for usable liquidity before chasing the rate
During the freeze, withdrawals and blocked new deposits could push utilization up sharply. Remaining borrowers could face higher rates even without changing their own positions. Reopening and the emergency rate adjustments can change that picture again.
LlamaRisk’s 13:49 UTC update reports two executed batches: temporary interest-rate reductions and borrow/draw-cap reductions. The first softens rate pressure; the second reduces unused borrowing capacity as markets reopen. The same update says GHO borrow-cap reductions on V3 Core and Prime were still queued. The original rate tables contain different limits across assets, so I would not turn the update into a universal, independently measured 10% cap. Check the actual reserve’s settings and rate.
A displayed supply rate is not an available opportunity while a reserve refuses new deposits. Once it reopens, a brief spike still tells you little about the return over the next month or whether the collateral can support the borrowing strategy you had in mind.
For fresh capital, I’d want three observations together: the exact reserve has reopened, enough liquidity is available for the exit I might need, and the rate still compensates for the exposure after the emergency adjustment. A falling rate as cash returns would change the calculation. So would a longer freeze or a new problem with collateral.
For scale, a temporary five-percentage-point annualized rate advantage lasting three days earns about $4.11 on $10,000, before costs, assuming a constant simple rate. That is an illustration, not a current offer. A rushed move between venues can cost more than the extra interest.
Onchain analytics: balances fell, but the cause needs care
DefiLlama’s Aave data shows tracked TVL falling from $17.65 billion to $15.73 billion, about 10.9%, between October 29 at 00:00 UTC and October 30 at 05:56 UTC. Active loans fell from $12.17 billion to $11.69 billion, about 4.0%, over the same window.
These are different measures. DefiLlama’s default TVL excludes active loans, staking and Pool2; it is not total gross deposits. Dollar values also move with asset prices. I would not call the TVL decline $1.92 billion of customer withdrawals without separating transfers, borrowing and repayments from valuation changes. Dashboard and methodology.
Aave’s tracked TVL fell 10.9% from October 29 at 00:00 UTC to October 30 at 05:56 UTC; active loans fell 4.0%. Recreated from DefiLlama API data, not a source screenshot. Dollar changes include balance and price effects. Source · Captured 2026-10-30T07:05:09Z.
Binance’s tracked wallet assets moved from $144.90 billion to $135.18 billion, a 6.7% decline, between October 29 at 00:00 UTC and October 30 at 05:25 UTC. Theft, price changes and transfers all affect that total. It measures tracked assets, without establishing customer liabilities, net withdrawals or solvency.
The near-term tests I’d watch are more specific: Binance actually reopening withdrawals, Aave completing the relevant reopening steps, available stablecoin cash recovering and a clearer account of the attacker’s collateral. Binance’s latest inspected statement still describes withdrawal reopening as a target. An expected reopening is not a completed one.
This Week’s Intel
1. Ethena’s Earn+ puts a leveraged strategy behind an app
Ethena Pay’s October 28 launch advertises up to 12% APY, with an initial $4.5 million cap. The external vault, managed by Upshift and Steakhouse, loops USDe collateral and USDT borrowing on Aave V4 Avalanche, targeting roughly 11x leverage. The rate is a target, and the launch’s exit description does not establish withdrawal availability after the incident. This is exactly why I’d check an app’s underlying route. Official launch.
Ethena Pay’s launch describes an external strategy on Aave V4 Avalanche, targeting about 11x leverage with a $4.5 million initial cap. Its launch withdrawal terms do not establish post-incident exit availability. Source · Captured 2026-10-30T17:11:34.878943+00:00.
2. ENSv2 launches on Ethereum mainnet
The October 27 release adds hierarchical registries and finer control over permissions and shared records. Existing names keep working; holders do not need to buy their names again. The changes are useful infrastructure, but launch alone tells us nothing about adoption or value reaching ENS holders. ENS announcement.
3. Uniswap makes fee conversion available to other apps
TJAR, announced October 29, lets applications collect fees in different tokens and have searchers convert them into a chosen asset. Uniswap says it is live on seven chains and already used by Robinhood. It helps turn scattered fees into usable treasury assets. The destination token is the app’s choice; this is not automatically a UNI buyback. Uniswap’s explanation.
4. BitGo clients get a Jupiter SOL staking route
BitGo’s October 28 announcement lets eligible institutional clients delegate SOL to a Jupiter-operated validator within their existing custody setup. That reduces an operational step for those clients. Rewards remain variable and unstaking still follows protocol timing; the announcement does not establish fresh inflows or income for JUP holders. BitGo announcement.
5. Electrum fixes a malicious-server fee-bump attack
The maintainers’ October 24 advisory describes a route in which a malicious server could alter the wallet’s view of an unconfirmed transaction. A subsequent fee bump could cause the user to sign an attacker payment. Version 4.8.3 contains the fix; the advisory says users of their own trusted servers were outside the reported exposure. Use the maintainers’ advisory to check affected versions and the official release. Electrum advisory.
Podcast Picks
Selected from publisher descriptions, chapters and available transcripts. These episodes predate the Binance incident and are context, not reporting on its cause.
1. Bankless: Black October
October 24 · David Hoffman with Hari Mulackal and Odysseas Lamtzidis. A discussion of automated attacks and how to limit the damage from one compromised service. The provider and safeguard discussion around 30:28–36:49 in the publisher transcript is the useful section for this week. Episode and transcript.
2. Unchained: America’s cyber privateers
October 27 · Laura Shin with J. Christopher Giancarlo and Ari Redbord. The guests examine the limits of private-sector responses to state-backed attackers. Useful for separating tracing, freezing and recovering funds. The episode supplies no attribution evidence for this incident. Episode.
3. Bankless: Michael Howell on liquidity
October 26 · Ryan Sean Adams and David Hoffman with Michael Howell. Howell explains which signals could change his liquidity outlook. His faster-recovery scenario remains conditional, a useful qualification when market headlines turn a possibility into a bottom call. Episode and transcript.
4. Bits + Bips: agents and idle bank deposits
October 27 · Austin Campbell, Ram Ahluwalia and Chris Perkins with Jim Bianco. Bianco argues that agents moving idle deposits could threaten a profitable source of bank funding. The incentive question is worth considering alongside security concerns; his explanation of banks’ motives remains an argument. Episode.
5. Bankless: the future of financial infrastructure
October 27 · David Hoffman with J. Christopher Giancarlo. A broader discussion of regulation, privacy and finance moving onchain. It complements the Unchained interview by looking beyond incident response to the controls built into financial infrastructure. Episode and transcript.
What I’m watching next
I still want access to useful lending markets. But I want to assess them under the conditions in which I might need my money back. This week makes reserve-level liquidity and emergency permissions part of that decision, alongside the rate.
For the next update, I’m watching confirmed withdrawals from Binance and Aave’s actual reserve changes. Neither a promise to reopen nor an attractive number on a yield screen settles whether a particular exit works.
If you want to compare the mechanics once conditions settle, revisit Aave, Morpho or Pendle? Where I’d Look for Yield and Would I Lock My USDC in Morpho Midnight?. Their rates and balances are dated.
Hit reply if a restriction changed how you could manage a position. The useful detail is which action you expected to have available.
Thanks for reading,
Yannis
For more DeFi commentary between editions, follow me on X.
For education and information, not investment, legal or tax advice. Rates, liquidity and emergency settings can change. Protocol, custody, collateral and issuer risks can cause losses. Check current official sources and your own circumstances before acting.