Mentioned in This Article
1. What is LlamaRisk planning for Aave lending?
LlamaRisk, the firm that manages risk parameters for the Aave lending protocol, intends to restrict how much can be borrowed on the platform within given windows of time. Chief executive Adam Sadowski described the plan on a podcast recorded on November 4, six days after a wallet linked to the Binance hot-wallet theft borrowed roughly $44.6 million in ether from Aave on October 29. No start date, cap size or period length has been disclosed.
The idea is a throttle rather than a ban. Instead of deciding in advance who may borrow, the protocol would limit the total pace at which new debt can be created, so that an unusually large draw cannot happen in a few minutes. Sadowski said the work is already under way and that the tool would act on what he called risk oracles, a mechanism that converts signals from the outside world into automatic adjustments on a decentralized finance protocol.
Because the plan arrives without technical detail, much of what can be said about it comes from how Aave is governed and from the incident that prompted it. The sections below set out what happened on October 29, how the position has fared since, what the proposed safeguard would build on, and which objections have already been raised.
2. How did a wallet tied to the Binance hack borrow $44.6 million?
According to an account LlamaRisk posted on Aave's governance forum, the wallet deposited 60 million USDT as collateral and withdrew 19,762 wrapped ether (WETH) in about three minutes on October 29. At the time, that amount of WETH was worth about $44.6 million. The deposit and the loan both took place on the Ethereum Core market of Aave V3, the protocol's largest deployment.
LlamaRisk places the address in the same cluster of wallets as the party behind the Binance hot-wallet theft, and the blockchain explorer labels it as an exploiter of that platform. The choice of collateral drew attention for a practical reason: Tether, the issuer of USDT, has the technical ability to freeze balances of its token. A thief posting a freezable asset as security for a loan in a different, unfreezable asset is an unusual arrangement, and it raised questions about how protocols should treat funds of suspect origin.
Aave itself was not drained. A lending protocol that accepts collateral worth more than the loan it issues is, in principle, protected by that margin. The concern is narrower: that a protocol designed to be open to everyone can be used within minutes to turn a large pile of suspect tokens into another asset that is far harder to trace or freeze.
3. What has happened to the position since the loan?
As of 16:04 UTC on November 5, the loan still carried a balance of about 9,885 WETH, which is roughly half of the original draw. The remaining collateral stood at about 35.57 million USDT and the position's health factor was approximately 1.24. A health factor above 1 means the collateral still exceeds what the protocol requires, while a reading at or below 1 allows liquidators to step in.
A liquidation has already taken place. At 14:49 UTC on November 4, a liquidator repaid about 9,884 WETH of the debt and received about 24.38 million USDT of the collateral in return. Sadowski said the position had started to enter liquidation. Liquidations are a normal part of how lending protocols stay solvent: third parties repay part of a borrower's debt and are paid in collateral at a discount, which keeps the system covered when prices move against a borrower.
Using the health factor, which Aave calculates with its own price oracle, the position would need ether to rise by about 24% before a further liquidation could occur. That figure is an estimate derived from the reported numbers, not a statement from Aave or LlamaRisk. The outcome therefore depends on the ether price over the coming days, and on whether the borrower repays or adds collateral.
4. Why did Aave freeze markets, and what stayed open?
Aave's guardians began freezing markets about 40 minutes after the borrowing. A freeze is a limited emergency measure. It stops new deposits and new borrowing in the affected market, but it leaves the exit routes untouched. Borrowers can still repay loans and withdraw collateral, and liquidators can keep working, which matters because liquidations are what protect the protocol while conditions are uncertain.
The Ethereum Core market has since reopened. One rule that also bears on the episode is that USDT and USDC deposited in that market currently add no borrowing power, because their loan-to-value ratio there is set at zero. A loan-to-value ratio states how much can be borrowed against a given asset, so a zero setting means those deposits cannot support new borrowing even though they remain deposited.
The forty-minute gap is central to Sadowski's argument. The guardians act through a four-of-seven multisig, meaning four of seven designated signers must agree before a transaction goes through. Coordinating people across time zones takes time, and an automated attacker needed only about three minutes to complete the borrowing. Sadowski contends that the difference in speed is a design weakness, not an operational failure by any individual.
5. How would risk oracles and automation change the process?
Sadowski argued that manual signers should gradually give way to automation, pointing out that AI agents now scan protocols for opportunities and can act on them faster than a committee. In his view, a risk manager's rules should be encoded in software that reacts to conditions as they occur, with humans setting the boundaries rather than approving each move.
He referred to Chainlink's Runtime Environment, known as CRE, a framework that lets risk managers run their own logic and publish the results onchain. LlamaRisk already uses it for a risk oracle covering Pendle principal tokens on Aave. According to the governance proposal for that oracle, the same architecture is intended to support others, including one that would manage supply and borrow caps. A time-based borrowing limit would be an extension of that existing infrastructure.
Risk stewards, the roles through which approved parties adjust parameters without a full governance vote, are run jointly by LlamaRisk and Aave Labs. Sadowski said the Aave DAO, the community of token holders that governs the protocol, decides how often a delegated operator may act and which parameters it is permitted to change. That keeps the final authority with the DAO even if an automated system carries out the adjustments.
6. What objections have been raised so far?
The proposal has drawn criticism from the same conversation in which it was announced. Kain Warwick, founder of Synthetix and a co-host of the show, noted that a limit applied to each account could be sidestepped by dividing borrowing among many wallets. Creating new addresses costs almost nothing, so a cap that tracks individual wallets might restrict ordinary users while barely slowing an attacker.
Sadowski answered that every risk management measure involves a trade-off. Warwick later cautioned that the unintended consequences of altering these systems are extremely high, a reminder that a protocol holding billions of dollars can be disrupted by a parameter that behaves differently than expected. Sadowski's reply was that the DAO sets the boundaries for what a delegated operator may do.
On the governance forum, LlamaRisk's own posts did not mention a limit tied to periods of time. Users there asked instead for flow limits, which restrict how quickly the total amount in a market can change. One participant, writing as gnarvaja, pointed to a proposal he made in April for an automated updater of supply caps that would restrict short-term increases in supply. The suggestion shows that similar ideas were already circulating before the Binance incident.
7. Why does a borrowing speed limit matter for DeFi lending?
DeFi lending depends on openness: anyone can deposit collateral and borrow without an application or a credit check. That property is also what allows a wrongdoer to use the market. Protocols have generally responded in one of two ways, by relying on guardians to pause markets after a problem appears, or by building limits into the code so that the damage from any single event is bounded in advance.
A rate limit on borrowing is an example of the second approach. It does not require anyone to judge whether a given wallet is tainted, which is difficult and can be wrong. It simply reduces the amount that can leave the system in a short interval, giving humans time to react. The same principle underlies circuit breakers in traditional markets, which pause trading after a sharp move rather than trying to identify its cause.
The design choices are consequential. A limit set too tightly would frustrate legitimate users such as funds moving large positions, while one set too loosely would offer little protection. Because borrowing demand rises and falls with the market, a fixed number may also need frequent revision, which is why Sadowski links the idea to automation instead of manual updates.
8. What happens next for the Aave borrowing cap?
No timetable has been given. Sadowski said LlamaRisk is building the solution, but he did not say when it would be proposed, how large the limits would be or over what periods they would apply. Any change affecting protocol parameters would be expected to go through the Aave DAO's process, where the objections already voiced by forum users and Warwick will probably be tested.
In the meantime, the open position keeps attracting attention. Its remaining debt of about 9,885 WETH, backed by roughly 35.57 million USDT of collateral, will move with the ether price, and observers will see whether it is repaid, topped up or liquidated further. The episode is likely to feature in the continuing discussion of how DeFi protocols should react when funds tied to a major theft appear on their platforms.