News linked to this event type.
Odaily Report: Derek Chiang, founder of ZeroDev and a developer involved with EIP-7702, posted on X stating that first, to be clear — EIP-7702 itself has no vulnerability. If you are using a wallet that supports EIP-7702 (MetaMask, Uniswap, Ambire, etc.), please do not panic.EIP-7702 is an Account Abstraction improvement proposal that allows externally owned accounts (EOAs) to sign a special message called a "7702 authorization," thereby embedding a smart contract into that account. This enables accounts to achieve powerful functionality, such as transaction batching — combining "authorization" and "transfer" into a single transaction, allowing you to complete a swap on Uniswap with just one click.Unfortunately, the same feature also allows hackers to efficiently transfer all your tokens in a single transaction. In the Binance hack incident, the hacker moved ETH, USDT, and 62 other tokens in one transaction, whereas without EIP-7702, they would have needed to send a separate transaction for each token. In this particular incident, many such transactions would have failed anyway, because Binance was still using the compromised wallet for withdrawals at the time, so all transactions sent by the hacker had to compete with legitimate transactions for Nonce (transaction sequence number). Therefore, using EIP-7702 did help the hacker steal funds as quickly and as extensively as possible.However, for the hacker to use EIP-7702, one of the following conditions must have been met: first, they obtained the private key; second, they tricked Binance into signing a 7702 authorization — the latter is highly unlikely, as it is hard to imagine Binance exposing an endpoint used for signing 7702 authorizations (or worse, signing raw messages that could be repackaged by the hacker for 7702 authorization). But until the official postmortem report is released, this possibility cannot be completely ruled out.Derek Chiang added: "As one of the contributors to account abstraction, I feel somewhat responsible for this hack incident, because while giving accounts more powerful functionality, we have indeed also given hackers stronger capabilities."
Odaily reports: According to monitoring by on-chain analyst Ai Yi, the UXLINK hacker-linked address (0xde8...9524) opened a 30,282.4 ETH long position on Hyperliquid. Its unrealized profit reached $7.422 million in the early hours of today, but has now narrowed to $2.45 million. The original post stated that ETH came under pressure and pulled back due to the recent Binance hack incident.
Odaily reports: According to Lookonchain monitoring, the Binance attacker has completed the sell-off of 7 tokens including UNI, ENA, PEPE, LINK, AAVE, ONDO, and WLD, cumulatively converting to 70,480 ETH, valued at approximately $158.25 million based on current quoted prices. Among them:UNI: sold 7.02 million tokens, worth $39.63 million, at an average price of $5.65;ENA: sold 217.5 million tokens, worth $33.93 million, at an average price of $0.16;PEPE: sold 7.77 trillion tokens, worth $31.66 million, at an average price of $0.0000041;LINK: sold 2.57 million tokens, worth $26.05 million, at an average price of $10.14;AAVE: sold 127,953 tokens, worth $14.27 million, at an average price of $111.55;ONDO: sold 21.85 million tokens, worth $6.62 million, at an average price of $0.30;WLD: sold 17.32 million tokens, worth $6.09 million, at an average price of $0.35.
Odaily Report: According to monitoring by Benson Sun, Coinkarma founder Benson Sun posted that in Binance's recent theft incident, the exchange has confirmed the freezing of approximately $2.5 billion in assets, accounting for about half of the total stolen amount, with the remaining assets primarily consisting of Bitcoin and ETH. The stolen Bitcoin is worth approximately over $1 billion, but Bitcoin lacks deep mixing pools similar to Tornado Cash, and the relevant addresses will be flagged by trading platforms and on-chain analytics firms, making it far more difficult to liquidate than ETH. Reviewing cases such as the 2016 Bitfinex stolen Bitcoin that remained untouched for years, and the approximately 1,800 BTC stolen from Coldcard in July this year with 90% still unmoved as of early September, Benson Sun stated that this theft is larger in scale, and splitting addresses, mixing coins, and then discounting through OTC trading could take years, with short-term selling pressure nearly zero. If Binance uses SAFU to compensate and replenish Bitcoin, it could instead create buying pressure. In contrast, large amounts of ERC-20 tokens converted into ETH and then deposited into Tornado Cash are harder to trace, and the amount that could genuinely translate into market selling pressure may be in the range of over $1 billion. Benson Sun believes that market confidence will be impacted, but the direct selling pressure on Bitcoin is not as large as imagined, and called on the industry to seriously address security arrangements for hot wallet management, signature authorization, and quantum resistance in the post-AI era.
Odaily — According to on-chain analyst Aunt Ai, 30 minutes ago, the Binance hot wallet hacker transferred all 74.56 million ARB to address 0x000...0DA0. Arkham has tagged this address as Kelp DAO Hacker, and these tokens have not yet been moved or sold. Kelp DAO suffered an attack on April 18 this year, losing approximately $292 million in rsETH, and at the time the community speculated that the attacker was the North Korean hacker group Lazarus Group.
Arbitrum officially announced that the Arbitrum Security Council has taken emergency action to transfer 74,559,805 ARB tokens and 8,425 ETH held by addresses associated with the Binance attack incident on Arbitrum One. Following technical assessment and review, the Security Council transferred the funds to an intermediate frozen wallet via a specific technical solution, without impacting other network states, users, or applications on Arbitrum.
Odaily reports: Trader Killa posted that he is still holding a BTC long position with an entry price of $76,400. Although a previous 15% unrealized gain has now been largely given back, his original target was a 75% to 100% return, so his current trading plan remains unchanged.Killa revealed that in his 10x leverage long strategy, the aggressive re-entry position at $82,800 will be stopped out at $74,000; if BTC drops to $74,000, he will reassess the market and consider establishing another 10x leverage long position. BTC is currently about 13% below its all-time high, possibly nearing the last major low of this cycle, and he expects the drawdown will not reach 20%. He specifically noted that the Binance FUD coincides with the timing of the U.S. midterm elections, and believes the current market panic may be the last bottoming-out before BTC begins a new significant rally.Amid market pressure and continuous FUD news, investors should stay calm and avoid making emotional decisions based on news or short-term price fluctuations. He stated that he will continue to hold the long position until the target price is reached or the stop-loss is triggered.
Odaily Report: KuCoin officially stated that it has noticed reports circulating on social media regarding a security incident affecting multiple platforms. KuCoin was not affected, user assets remain safe, systems are operating normally, and both trading and withdrawal services are fully available.
Bonk Guy posted on X stating that the Binance incident is unlikely to trigger systemic risk. Binance is reportedly generating annual revenue of approximately $16-17 billion, and nearly half of the funds involved in this incident have already been frozen or may be recovered. The amount that may ultimately be unrecoverable is approximately $3.2 billion, equivalent to about 2 to 2.5 months of Binance's revenue, which remains manageable relative to its operating scale.Bonk Guy noted that both Changpeng Zhao (CZ) and He Yi have publicly stated that user funds are safe and that all losses will be fully covered. He believes the likelihood of systemic risk and a bank run is extremely low, and that the market should be more vigilant about panic selling and media overhyping, reminding investors not to make trading decisions based on panic sentiment.
Odaily reports: According to on-chain analyst Aunt Ai, a hacker has sold off all 7.77 trillion PEPE tokens from Binance's hot wallet, exchanging them for 14,049 ETH worth over $31.9 million, at an average selling price of approximately $0.0000041, causing PEPE's price to drop 12.33%. Currently, the unrealized profit on the 11.8 trillion PEPE transferred out by Brother Sun since October 17 has shrunk to $4.45 million, with an average withdrawal price of approximately $0.000004114; last night, his unrealized profit had once reached $18.55 million.
Odaily reports: According to monitoring by on-chain analyst Yu Zhan, Binance appears to have suffered a large-scale security incident in the early hours of today, with approximately $3.43 billion in assets stolen. This figure excludes about $2.43 billion in stablecoins that stablecoin issuers helped freeze.Among the stolen assets, the largest single item was 18,270 BTC, worth approximately $1.44 billion, and the relevant BTC has not yet been moved. Meanwhile, the hacker is converting other altcoins into ETH, and the ETH held has now reached approximately 467,000, worth about $1.06 billion.
Odaily reports: Smart contract developer Justin Kalland posted on X that the Binance hacker appears to have made a potential mistake, and MetaMask should retain as much of any Web2 logs as they can obtain.Specifically, the hacker sent 175 million USDT to a new wallet, and about 2.5 minutes later, that wallet also received 2 ETH. This was likely used to pay for Gas fees, consistent with the pattern used by their other attack wallets.Exactly two minutes after that, the wallet used MetaMask's Gas Station service, even though it already had Gas fees at the time. Three consecutive transactions landed in the same block — an ETH top-up from Gas Station, an infinite USDT approval to the Kyber Network router, and a payment of 127.67 USDT to Gas Station. The amount of the ETH top-up exactly matched the combined maximum Gas budget of the Kyber approval and the USDT payment. Accurate down to wei (the smallest Ethereum unit).But the problem is that the ETH they had at the time was already fully sufficient to cover both fees, so a reasonable speculation is that they were using a MetaMask wallet at the time and, due to haste, mistakenly selected USDT to pay for Gas fees. For convenience, MetaMask sometimes defaults to this method, and the order of top-ups within the same block also matches how its implementation mechanism works.To use Gas Station in MetaMask, users must use MetaMask Sentinel. This means the transactions were broadcast through them, rather than through a regular RPC. This interaction likely left off-chain records at MetaMask, which may include IP metadata.Among all the attacker's wallets that have been checked, this is the only wallet showing use of Gas Station, and the wallet address is: 0xAa246BF639586a6Ba46762D378CE50cA4fc654a0.
Odaily report: A wallet suspected to be associated with the Binance hack incident received tens of thousands of ETH through a Uniswap contract and borrowed 19,762 ETH on Aave using approximately $60 million in USDT as collateral. On-chain records do not show any vulnerabilities in Uniswap or Aave.As of 22:07 UTC, the two wallets held approximately 253,000 ETH, worth about $570 million, with no outgoing transfers recorded. Aave has paused the Ethereum mainnet V3 market, and Kamino has also paused borrowing in the SOL/BTC market; Ripple has frozen approximately $200 million in RLUSD, and more than $2 billion in USDT and USDC has been frozen by stablecoin issuers. (Decrypt)
Odaily Report: According to monitoring by Bitcoin News, on-chain analysis shows that after attackers exploited a malicious EIP-7702 authorization to take control of a Binance wallet, the wallet's key remained usable. Binance reportedly used the signing key to execute transactions through the compromised wallet, recovering $823 million in USDC. The attackers reportedly obtained 50 valid authorizations signed by the wallet's key, one of which successfully activated malicious code and moved 65 types of assets. Even after Tether and Circle blacklisted the attackers' addresses, the asset transfers reportedly continued; a $200 million USDT deposit was moved out just 100 seconds after it arrived.
According to Lookonchain monitoring, the Binance hacker is currently dumping PEPE, UNI, LINK and other tokens on-chain in exchange for ETH. Lookonchain states that the hacker still holds a large amount of altcoins that may face significant selling pressure, including 217.497 million ENA (worth $39.51 million), 7.579 trillion PEPE (worth $34.41 million), 2.575 million LINK (worth $28.07 million), 128,034 AAVE (worth $15.9 million), 74.56 million ARB (worth $11.54 million), 1.938 million UNI (worth $12.62 million), 21.852 million ONDO (worth $8.52 million), 17.318 million WLD (worth $6.73 million), 714.911 million FUN (worth $6.29 million), 87.853 million ZAMA (worth $6.02 million), 3.602 million ZRO (worth $5.69 million), and 3.382 billion RSR (worth $5.02 million).
According to Whale Alert, the address labeled "Binance Hack 2026" transferred approximately 2.568 million LINK tokens (worth around $27.95 million) to an unknown wallet at 06:40 Beijing Time.
Odaily Report: According to monitoring by Bitcoin News, Binance is reportedly still operating its automatic deposit sweeping function, routing newly deposited user funds into a compromised hot wallet. Attackers are reportedly continuing to move funds out of the wallet as new deposits arrive, putting user deposits at potential risk. Related advisories recommend that users avoid depositing funds until the incident is resolved.
According to Whale Alert, an address tagged as "Binance Hack 2026" transferred approximately 217 million ENA (worth around $40.38 million) to an unknown wallet at 06:03 Beijing Time.
Blockaid stated that the attacker batch-submitted 50 EIP-7702 authorizations in a single transaction to hit Binance's hot wallet real-time nonce; only one succeeded, after which the wallet was subsequently upgraded to a receiving contract. The associated address also transferred out approximately $37.48 million worth of PEPE.
According to monitoring by Bitcoin News, a Bitcoin address labeled as a hot wallet in Binance's own transparency disclosures reportedly had approximately 17,500 BTC transferred out. The transfer occurred amid reports of a major security incident involving a Binance-linked Ethereum wallet. It is currently unclear whether this Bitcoin transfer was unauthorized or a movement made for security reasons.