Aave’s Risk Manager Wants a Borrowing Speed Limit After Binance Hackers Took $44.6 Million

LlamaRisk, the risk manager for lending protocol Aave, is going to put a throttle on how much can be borrowed on Aave over certain periods of time, CEO Adam Sadowski said during an episode of Uneasy Money recorded Nov. 4. The comments came six days after a wallet tied to the Binance hot-wallet hack posted USDT, a stablecoin its issuer can freeze, as collateral on Aave and borrowed ether against it. LlamaRisk places that wallet in the exploiter’s cluster, and Etherscan labels it a Binance hot-wallet exploiter.

Sadowski said LlamaRisk is building a solution right now, which he introduced by referring to risk oracles, systems that take real-world signals and turn them into actions on a DeFi protocol. In this case, he said, it would limit “the borrowing capability over certain time periods.” He gave no timeline or design details, such as the size of the limits or the length of each period.

Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.

60 Million USDT In, 19,762 WETH Out

The wallet’s loan on Aave V3’s Ethereum Core market still owed about 9,885 WETH at 16:04 UTC on Nov. 5, against about 35.57 million USDT of collateral, a health factor of about 1.24, onchain data shows. That is roughly half of the 19,762 WETH, then worth about $44.6 million, it drew against 60 million USDT over about three minutes on Oct. 29, according to LlamaRisk’s account on Aave’s forum. A liquidator repaid about 9,884 WETH at 14:49 UTC on Nov. 4 and took about 24.38 million USDT; Sadowski said the position “has started to enter liquidation.” Computed from the health factor, which Aave calculates with its own price oracle, ether would have to rise about 24% before the position could be liquidated again.

Guardians began freezing Aave’s markets about 40 minutes after the borrowing. Liquidators kept working through the freeze, and borrowers could still repay loans or withdraw collateral; only fresh deposits and new borrowing were shut off. Ethereum Core has since reopened, though USDT and USDC deposited there still add no new borrowing power, since their loan-to-value ratio sits at zero.

Manual Signers and Automation

Aave’s guardians are a “four of seven multisig that have to align to take action,” Sadowski said, and risk stewards are run jointly by LlamaRisk and Aave Labs. He argued that manual signers must give way to automation because “we’re having AI agents that are scanning for exploit opportunities and taking advantage of them.” He also pointed to Chainlink’s Runtime Environment (CRE), which lets risk managers run their own logic. LlamaRisk’s risk oracle for Pendle principal tokens (PT) on Aave already runs on CRE, and the firm’s governance proposal for it said the same setup is designed to take on other oracles, among them one for supply and borrow caps.

LlamaRisk’s posts in the forum thread did not mention a time-based limit, though users there asked for flow limits. One, gnarvaja, pointed to his April proposal for an automated supply-cap updater.

Kain Warwick, the Synthetix founder who co-hosts the show, said a per-account limit could be beaten by splitting borrowing across many wallets; Sadowski answered that “there’s always a trade-off” with any kind of risk management action. Warwick later said “the unintended consequences of changing these systems is extremely high.” Sadowski replied that the Aave DAO sets how often a delegated operator can act and which parameters it can change.

{"@context":"https:\/\/schema.org","@id":"https:\/\/unchainedcrypto.com\/aaves-risk-manager-wants-a-borrowing-speed-limit-after-binance-hackers-took-44-6-million\/#arve-youtube-5wdvwxhok90","@type":"VideoObject","embedUrl":"https:\/\/www.youtube-nocookie.com\/embed\/5WDvWxHOK90?feature=oembed&iv_load_policy=3&modestbranding=1&rel=0&autohide=1&playsinline=1&autoplay=0","name":"Uneasy Money: What the $6B Binance Hack Revealed About Who Can Freeze Stolen Funds","description":"The $6B Binance hack sent stolen funds through Aave. LlamaRisk CEO Adam Sadowski walks through the market freeze and why nothing was taken from the protocol.","thumbnailUrl":"https:\/\/unchainedcrypto.com\/wp-content\/uploads\/2026\/11\/2-2.png","uploadDate":"2026-11-05T16:22:51+00:00"}

The post Aave’s Risk Manager Wants a Borrowing Speed Limit After Binance Hackers Took $44.6 Million appeared first on Unchained.