Tom Lee says DeFi needs to find a way to prevent related incidents from happening
On October 29, 2026, Fundstrat co-founder Thomas Lee posted on X that DeFi needs to find a way to prevent these “de-tarded” things from happening. The post cited a discussion by user Bala about a Binance-related incident.
In the cited post, Bala said that Tether froze about $1.5 billion in USDT and Circle froze about $800 million in USDC; he also said that the attacker deposited the stolen USDT into Aave and borrowed ETH before leaving, because USDT can be frozen while ETH cannot. Lee’s comment was directed at that description and did not provide specific technical advice or a protocol proposal.
On the same day, Aave officially said it had, in response to reports of a potential incident involving Binance-affiliated wallets, preemptively frozen all DAO-operated V3 and V4 markets and suspended new deposits and borrowing. Paxos also froze 1,906.67 PAXG associated with the suspected attacker address. Binance officially confirmed that it is conducting a security review, and withdrawals will resume after the issue is resolved.
Lee’s statement was a personal opinion and was not accompanied by any implemented changes to DeFi mechanisms.
Original sources:
Title: Defi needs to find a way to prevent these "de-tarded" things from happening Publisher: Thomas Lee (@fundstrat) Date published: 2026-10-29 URL: https://x.com/fundstrat/status/2115943613251387791 Source type: personal original post Verification status: full post read in this review, verification date 2026-10-29 Supporting content: Lee said that DeFi needs to find a way to prevent related incidents from happening, citing a discussion about using frozen USDT as collateral to borrow ETH
Title: the binance hacker just did something genius... Publisher: Bala (@BalaiBB) Date published: 2026-10-29 URL: https://x.com/BalaiBB/status/2115929049348309112 Source type: personal original post Verification status: related content read in this review, verification date 2026-10-29 Supporting content: the cited post said the attacker used frozen USDT to borrow ETH on Aave (background)
Title: We’re aware of reports of a potential incident affecting Binance-affiliated wallets... Publisher: Aave (@aave) Date published: 2026-10-29 URL: https://x.com/aave/status/2115937863162339637 Source type: official announcement Verification status: official post read in this review, verification date 2026-10-29 Supporting content: Aave preemptively froze markets (background)
ABAB AI Insight
Lee’s comment points to a path in which assets that can be frozen are used as collateral in lending protocols and then converted into assets that cannot be frozen. After an apparent abnormal outflow from Binance hot wallets, stablecoin issuers blacklisted and locked some USDT and USDC, but if those assets could still be deposited into lending markets as collateral before or after the freeze, the attacker could convert part of the value into native assets such as ETH. Aave’s market freeze on the same day, which suspended new deposits and borrowing, was a preventive block against that path.
In terms of capital flow, the freeze function exists at the token issuer level, while access control in lending protocols exists at the market-parameter level. The two are not automatically linked. Lee’s call for DeFi to find a way to prevent this is an observation about a gap in existing mechanisms, not a description of an already implemented solution. The actual effect depends on whether each protocol proactively adjusts parameters when an incident occurs and whether the relevant assets have already been covered by issuer blacklists.
Unlike exchange withdrawal suspensions or issuer blacklists, risk isolation in lending protocols depends on the speed with which governance or emergency mechanisms are triggered. Indicators to watch include whether major lending protocols announce parameter-adjustment rules for suspicious asset inflows, and whether relevant addresses still have open collateral positions after the freeze.
ABAB News · Cognition Law
When freezeable assets are used as collateral in lending protocols, they can be converted into non-freezable assets; issuer blacklists and protocol access control are different layers.
In external incidents, DeFi protocols must rely on their own parameter adjustments or governance mechanisms to block the collateral path for suspicious assets.