On October 29, 2026, the Binance hot wallet incident occurred suddenly, with specific losses and details of the attack yet to be made public, but it quickly triggered a reaction in the DeFi sector: during the same time frame, on one end, the leading lending protocol Aave actively hit the brakes, freezing V3 and V4 reserves, and under the advice of risk service provider LlamaRisk, preparing to tighten the borrowing limits of 27 reserve assets in V3 and the withdrawal limits of 6 credit lines in V4 to about 1.02 times the borrowing amount before the attack, in order to reduce the large amounts of available borrowing limits that had not yet been utilized; on the other end, the cross-chain liquidity protocol THORChain was again pointed out by on-chain analyst ZachXBT, who indicated that some of the funds from the Binance and September Bitget theft incidents had been transferred via THORChain to the same Ethereum address. On October 30, THORChain's native token RUNE saw an over 10% increase in a single day, priced at approximately $0.659. One is reinforcing firewalls in governance proposals, while the other experiences price fluctuations amidst public controversy; these vastly different on-chain and market reactions will become the core of the following analysis: we will compare the responses of lending protocols and cross-chain liquidity protocols under security shocks, trace the logic behind specific address and limit adjustments, and discuss the potential reshaping of overall risk preferences among DeFi participants due to this round of shocks.

After the Binance hot wallet scare: Aave hits the brakes

Shortly after the Binance hot wallet incident was revealed on October 29, the leading lending protocol Aave on the other side of the chain chose to slam the brakes. According to public materials, while the market was still inquiring about the loss amount and attack details, Aave preemptively froze its V3 and V4 reserves—the core pools covering multiple chains and asset types were put on pause; the specific freezing time point and asset list have not been disclosed, but the timing clearly constituted a rapid defensive response to external shocks.

The subsequent narrative shifted from “emergency braking” to “careful contraction.” Shortly after the freeze operation, risk service provider LlamaRisk submitted a governance proposal to the Aave community, suggesting lowering the borrowing limits of 27 reserve assets in V3 and the withdrawal limits of 6 credit lines in V4, with new limits roughly set at about 1.02 times the borrowing amount prior to the attack, and planning to remove approximately $3.7 billion of unused borrowing limits in V3 and about $130 million in unused limits in V4. In other words, this round of adjustments targeted the available borrowing access that had not yet been utilized, deliberately bypassing existing loans, and prioritizing reducing potential risk channels. However, as of October 30, publicly available information did not provide the voting results or effective time for this proposal, nor were there any official documents directly linking this round of freezing and limit adjustments to a causal response to the Binance incident; both actions can only be regarded as highly synchronized defensive moves within the same timeframe.

$3.7 billion of unused limits recalled: How Aave protects itself

LlamaRisk's proposal was essentially a blanket governance surgery aimed at “limits” rather than “positions.” For Aave V3, the proposal named 27 reserve assets to lower their borrowing limits; for V4, it directly tightened the withdrawal limits of 6 credit lines. The new limits were uniformly set at approximately 1.02 times the borrowing amount before the attack—almost on par with the actual borrowing level at that time, leaving only a very thin buffer for the system. Public materials did not provide the absolute borrowing scale before the attack, but according to the proposal’s estimates, Aave plans to reclaim approximately $3.7 billion of unused borrowing limits from V3 and about $130 million from V4, totaling about $3.83 billion of “potential leverage space” erased from the parameters.

The key point is that these limits had not yet been utilized by users, thus not directly cutting positions of existing borrowers, but rather locking in future risk space that might have been fully utilized at once. Aave chose to draw the safety boundary at “how much can still be borrowed,” rather than adjusting existing collateral borrowing relationships, thus avoiding triggering a chain liquidation amid panic; by reducing unused limits, the protocol minimized its systemic exposure under extreme events. The proposal has currently not disclosed voting results or effective time, but from the design perspective itself, it is evident that leading DeFi lending protocols are more inclined to control the market by tightening available limits under pressure, rather than confront the existing leverage in the entire network post-event.

RUNE rises by over 10%: Controversy over stolen funds’ pathway

On one side, the lending protocol reduced leverage by shrinking limits, while on the other side, the cross-chain liquidity track welcomed a price fluctuation amidst controversy. According to market data, THORChain's native token RUNE saw a single-day increase of over 10% on October 30, priced at approximately $0.659. The movement itself was not particularly remarkable, but because it coincided with accusations regarding the “pathway for stolen funds,” it was scrutinized closely. On that day, on-chain analyst ZachXBT disclosed that some assets from the Binance hot wallet incident and the September Bitget theft were exchanged and transported through THORChain after moving out of their original chains, eventually flowing into the same Ethereum address. The exact amount stolen in the Bitget incident and the methods of attack have not been publicly detailed, but this pathway highlights THORChain's role as a cross-chain asset transfer hub and exposes the complexity of tracking suspicious funds when native assets can freely switch between multiple chains.

It is important to emphasize that the existing public information can only confirm two things: first, RUNE's price did indeed see an over 10% increase on October 30; second, on the same day, ZachXBT's disclosures repeatedly named THORChain in the fund transfer pathways of the Binance and Bitget incidents. As for whether this negative public opinion directly influenced the price movement, there is currently no on-chain or trading data available to provide causal proof, nor has THORChain officially responded to this pathway or faced direct regulatory penalties. In the absence of evidence, this more resembles an intersection of “price increase” and “pathway controversy” in the same coordinate system, rather than a verified causal chain.

Cross-chain pathways and compliance shadows: THORChain's double-edged sword

Functionally, THORChain is doing something highly infrastructural: enabling direct exchanges of native assets between multiple mainstream public chains, allowing users to move assets between chains without going through centralized custody or intermediary layers for wrapped assets. For compliant users, this means higher capital efficiency and less custody risk; but for attackers trying to evade tracking, it also means they can “jump” between different chains, using combinations of multiple public chains and assets to extend funding paths, making this neutral tool naturally targeted by both sides.

Therefore, after ZachXBT disclosed that some funds from the Binance hot wallet incident and the September Bitget theft were transferred via THORChain to the same Ethereum address, this cross-chain pathway was once again thrust into the spotlight. Being repeatedly named as a suspicious fund pathway is enough to place brand pressure on THORChain: even though the protocol code does not “choose” which type of users to serve, the public and regulatory perspectives often do not scrutinize this layer of technical neutrality. Existing public information shows that THORChain has not publicly responded to this fund path disclosure, nor have any regulatory bodies issued specific enforcement actions against the protocol, but in the background where cross-chain and privacy-related protocols have been repeatedly involved in discussions of hacker funds transfer paths, this narrative is likely to extend into the compliance expectations for the entire cross-chain track, with THORChain merely being the first sample under the spotlight.

DeFi survival rules after security incidents

Returning to this chain of events, Aave chose a path of “active contraction”: after the Binance hot wallet incident, it froze V3 and V4 reserves and planned to lower the limits of 27 V3 reserve assets and 6 V4 credit lines in the LlamaRisk proposal, setting new limits around 1.02 times the pre-attack borrowing amount, while preparing to remove approximately $3.7 billion in unused borrowing limits from V3 and $130 million from V4, thereby preemptively closing off a total of about $3.83 billion in potential exposure; these actions are largely preventive measures against future risks. In contrast, THORChain, as a native asset cross-chain exchange protocol, did not undergo known adjustments due to this disclosure, yet faced public scrutiny because ZachXBT pointed out that two stolen funds flowed through its paths to the same Ethereum address; within the same timeframe, RUNE's price increased over 10%, but currently, only the temporal overlap with the disclosed events can be confirmed, lacking direct causal evidence. One is tightening the valves at the governance level, while the other bears the compliance and narrative risks in the guise of technical neutrality; this outlines the two survival themes of current DeFi vividly. What remains to be seen is whether Aave’s governance proposal to reduce unused limits can pass and when it will be implemented, whether other leading lending protocols will be forced to follow suit with similar limit contractions, and how they will proactively adjust in design and operation to avoid being pushed into a more passive position by both the market and regulators during the next security shock.

Join our community, let's discuss and become stronger together!
AiCoin exclusive Hyperliquid benefits: https://app.hyperliquid.xyz/join/AICOIN88
AiCoin exclusive Aster benefits: https://www.asterdex.com/zh-CN/referral/9C50e2
On-chain Telegram community: https://t.me/AiCoinWhaleData
On-chain community: https://www.aicoin.com/link/chat?cid=N6OVMor5g
AiCoin on-chain Twitter: https://x.com/aicoinwhaledata

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。