News linked to this event type.
Odaily reports: According to on-chain analyst Aunt Ai, a hacker has sold off all 7.77 trillion PEPE tokens from Binance's hot wallet, exchanging them for 14,049 ETH worth over $31.9 million, at an average selling price of approximately $0.0000041, causing PEPE's price to drop 12.33%. Currently, the unrealized profit on the 11.8 trillion PEPE transferred out by Brother Sun since October 17 has shrunk to $4.45 million, with an average withdrawal price of approximately $0.000004114; last night, his unrealized profit had once reached $18.55 million.
According to CoinDesk's analysis, the hacked Binance Hot Wallet 14 was listed in Binance's October 1 Proof of Reserves; following the theft of approximately 204,500 ETH, its ETH backing ratio may drop from 100% to around 94%, with the next reserve snapshot scheduled for November 1.
According to monitoring by ZachXBT, the Arbitrum Security Council has executed a transaction to freeze approximately $30.5 million in funds from the Binance attack incident.
Jack McDonald, Ripple's stablecoin lead, posted that Ripple is closely monitoring reports that Binance may have suffered an attack and that the attacker holds RLUSD, and has proactively frozen the affected funds. Ripple stated that it is currently coordinating with relevant parties and is ready to cooperate with the investigation and take appropriate action at any time to protect the safety of user assets.
Odaily report: Binance co-founder He Yi stated in a post that user funds are safe, and Binance will bear all losses caused by this hacker attack. Currently, the platform has temporarily suspended deposits and withdrawals to allow the security team to conduct security checks, freeze related funds, and cooperate with law enforcement authorities.He Yi stated that after the investigation is completed, Binance will publish a full incident review report and reminded users to obtain the latest updates only through Binance's official channels.
Odaily reports: According to monitoring by on-chain analyst Yu Zhan, Binance appears to have suffered a large-scale security incident in the early hours of today, with approximately $3.43 billion in assets stolen. This figure excludes about $2.43 billion in stablecoins that stablecoin issuers helped freeze.Among the stolen assets, the largest single item was 18,270 BTC, worth approximately $1.44 billion, and the relevant BTC has not yet been moved. Meanwhile, the hacker is converting other altcoins into ETH, and the ETH held has now reached approximately 467,000, worth about $1.06 billion.
Odaily reports: Smart contract developer Justin Kalland posted on X that the Binance hacker appears to have made a potential mistake, and MetaMask should retain as much of any Web2 logs as they can obtain.Specifically, the hacker sent 175 million USDT to a new wallet, and about 2.5 minutes later, that wallet also received 2 ETH. This was likely used to pay for Gas fees, consistent with the pattern used by their other attack wallets.Exactly two minutes after that, the wallet used MetaMask's Gas Station service, even though it already had Gas fees at the time. Three consecutive transactions landed in the same block — an ETH top-up from Gas Station, an infinite USDT approval to the Kyber Network router, and a payment of 127.67 USDT to Gas Station. The amount of the ETH top-up exactly matched the combined maximum Gas budget of the Kyber approval and the USDT payment. Accurate down to wei (the smallest Ethereum unit).But the problem is that the ETH they had at the time was already fully sufficient to cover both fees, so a reasonable speculation is that they were using a MetaMask wallet at the time and, due to haste, mistakenly selected USDT to pay for Gas fees. For convenience, MetaMask sometimes defaults to this method, and the order of top-ups within the same block also matches how its implementation mechanism works.To use Gas Station in MetaMask, users must use MetaMask Sentinel. This means the transactions were broadcast through them, rather than through a regular RPC. This interaction likely left off-chain records at MetaMask, which may include IP metadata.Among all the attacker's wallets that have been checked, this is the only wallet showing use of Gas Station, and the wallet address is: 0xAa246BF639586a6Ba46762D378CE50cA4fc654a0.
Crypto KOL 0xPickleCati believes the suspected hack at Binance currently resembles more of a security incident than an FTX-style solvency crisis, but the market may experience further declines over the next 72 hours, and they are preparing to buy in tranches.
In the suspected hack on Binance, analysts suggest attackers may have exploited the EIP-7702 mechanism to control wallets. User 0xVEER on X stated that developers had already warned approximately two years ago, during discussions on EIP-7702, that this mechanism could lead to the theft of all assets, including native tokens.
Odaily Report: Marc Zeller, founder of the Aave Chan Initiative (ACI), posted on X stating that the Aave protocol is fine.The Binance hacker injected 60 million USDT into the protocol within just 3 minutes and borrowed 19,762 wETH (approximately $44.9 million), at which point Tether had not yet frozen the address, nor had the Aave Guardian frozen the Aave V3 Core pool's reserves (this operation occurred 46 minutes later).However, USDT is backed by real dollars, and from the protocol's perspective, although this position is the proceeds of crime, it is overcollateralized — with a health factor of 1.04, holding $59.9 million in collateral against $44.9 million in debt.Of course, the protocol now has a large borrower with little incentive to repay the loan, but the liquidation mechanism will still operate as usual. If the ETH price rises above approximately $2,365 (+4%), the position will be liquidated just like any other position.Currently, the Aave V3 Core pool's total wETH reserves stand at 2.16 million wETH, and the hacker's debt accounts for "only" 0.9% of that, so Aave does not need to take any special action against the hacker. There are currently 345,000 wETH available (capital utilization rate of 81.6%), so if wETH depositors wish to withdraw, liquidity is fully sufficient. There is no reason or need for a bank run to occur.This situation is far less alarming than the Kelp hacker incident (which involved zero-value collateral). In theory, a governance proposal could be passed to force liquidation of the hacker by upgrading the pool (if the USDT liquidation threshold were lowered, it would affect all USDT depositors), but there is no practical benefit to doing so, as the normal liquidation mechanism can easily absorb this debt.
Odaily report: Shenyu posted on X, saying: "Binance 14's 7702 delegation still has not been revoked after 2 hours. A transfer of 2,961 ETH to Binance 14 is still stuck, remaining pending due to a low gas fee. Once it goes on-chain (when the base fee falls below 4.4 gwei), an attacker could sweep away the roughly 2,961 ETH again."
Bybit founder and CEO Ben Zhou stated that reports of security incidents at multiple platforms are circulating on social media. Bybit has not been affected in any way, its systems are operating normally, trading and withdrawal functions remain available, and user assets are secure. Bybit is willing to provide support to Binance in multiple areas.
Odaily report: A wallet suspected to be associated with the Binance hack incident received tens of thousands of ETH through a Uniswap contract and borrowed 19,762 ETH on Aave using approximately $60 million in USDT as collateral. On-chain records do not show any vulnerabilities in Uniswap or Aave.As of 22:07 UTC, the two wallets held approximately 253,000 ETH, worth about $570 million, with no outgoing transfers recorded. Aave has paused the Ethereum mainnet V3 market, and Kamino has also paused borrowing in the SOL/BTC market; Ripple has frozen approximately $200 million in RLUSD, and more than $2 billion in USDT and USDC has been frozen by stablecoin issuers. (Decrypt)
According to Decrypt, Binance co-CEO He Yi stated that Ripple has frozen approximately $200 million in RLUSD; suspected hackers are converting freezeable stablecoins into ETH via Uniswap and Aave, while Kamino has suspended SOL/BTC market lending.
Odaily Report: According to monitoring by Bitcoin News, on-chain analysis shows that after attackers exploited a malicious EIP-7702 authorization to take control of a Binance wallet, the wallet's key remained usable. Binance reportedly used the signing key to execute transactions through the compromised wallet, recovering $823 million in USDC. The attackers reportedly obtained 50 valid authorizations signed by the wallet's key, one of which successfully activated malicious code and moved 65 types of assets. Even after Tether and Circle blacklisted the attackers' addresses, the asset transfers reportedly continued; a $200 million USDT deposit was moved out just 100 seconds after it arrived.
OKX founder Star praised Circle and Tether for their freezing actions in the suspected theft incident at Binance, calling on exchanges and stablecoin issuers to jointly establish an industry-wide real-time early warning and rapid freeze mechanism.
According to Lookonchain monitoring, the Binance hacker is currently dumping PEPE, UNI, LINK and other tokens on-chain in exchange for ETH. Lookonchain states that the hacker still holds a large amount of altcoins that may face significant selling pressure, including 217.497 million ENA (worth $39.51 million), 7.579 trillion PEPE (worth $34.41 million), 2.575 million LINK (worth $28.07 million), 128,034 AAVE (worth $15.9 million), 74.56 million ARB (worth $11.54 million), 1.938 million UNI (worth $12.62 million), 21.852 million ONDO (worth $8.52 million), 17.318 million WLD (worth $6.73 million), 714.911 million FUN (worth $6.29 million), 87.853 million ZAMA (worth $6.02 million), 3.602 million ZRO (worth $5.69 million), and 3.382 billion RSR (worth $5.02 million).
According to Whale Alert, the address labeled "Binance Hack 2026" transferred approximately 2.568 million LINK tokens (worth around $27.95 million) to an unknown wallet at 06:40 Beijing Time.
Odaily Report: According to monitoring by Bitcoin News, Binance is reportedly still operating its automatic deposit sweeping function, routing newly deposited user funds into a compromised hot wallet. Attackers are reportedly continuing to move funds out of the wallet as new deposits arrive, putting user deposits at potential risk. Related advisories recommend that users avoid depositing funds until the incident is resolved.
according to Bitcoin News monitoring, attackers allegedly used EIP-7702 delegation to point the Binance Wallet to malicious code, thereby transferring funds. How the attacker obtained authorization is still under investigation, with two possibilities currently: the private key was stolen, or the attacker obtained a malicious authorization signature through a compromised signing process. Neither scenario has been confirmed. If the private key was not stolen, this attack may expose a significant vulnerability in the exchange's transaction authorization mechanism, rather than a private key security issue.