News linked to this event type.
Cryptocurrency exchange Binance said it will publish the results of its proof of reserves on November 2. Binance stated on October 30 that it has recovered approximately 80% of the stolen assets and is still processing the remainder; the proof-of-reserves snapshot is planned to be taken after the buyback is completed. Some users on Platform X have questioned that taking a snapshot after the buyback cannot reflect the previous asset shortfall, and the related insider-job claims currently have no solid evidence to support them.Blockchain intelligence firm TRM Labs attributed the theft to the North Korean hacker group Tradertraitor and said it has high confidence in this judgment. TRM Labs stated that the attackers may have controlled Binance's hot wallet signing system, and the funds were transferred out via ten blockchains in about 20 minutes; Elliptic said that a North Korea-linked group may be involved, but no government or law enforcement agency has yet confirmed the attribution.Binance said it has discovered other points of intrusion and that there is no evidence that wallet private keys were leaked; co-CEO Richard Teng stated that only Binance's own hot wallet was compromised and that customer funds were unaffected. Binance said withdrawals are expected to resume in stages within about 34 hours, after which it will publish the reserves report and a full technical post-mortem. (Bitcoin.com News)
According to Arkham monitoring, approximately 20 minutes ago, an address tagged as the Binance hacker transferred 120 million TRX tokens, worth about $38.54 million, and these tokens were subsequently transferred again to multiple addresses.
In response to claims of a confrontation with Musk, CZ stated that Musk is one of the world's strongest builders, that he has no intention of clashing with him, and called for action against North Korean hackers.
Axel Adler Jr.'s chart shows that the cost basis for Bitcoin short-term holders is approximately $75,900. He noted that the market's reaction to the Binance hack so far has been relatively restrained.
Stonk stated that the StonkFun official website, proactively taken offline due to a domain name attack, has resumed access and been migrated to new infrastructure. On-chain functions are operating normally, and no user impact has been detected so far.
Odaily Report: CZ posted on X in response to discussions about SPCX stock, stating that he never said he wanted to sell SPCX shares. He previously mentioned holding the stock because a related post comparing Binance with FTX might have led outsiders to mistakenly believe that Binance lacks funds; what he actually meant to express was that Binance holds other assets in addition to crypto assets.CZ also stated that the scale of the relevant assets held by Binance is merely a drop in the ocean for the other party and could not possibly pose a threat, and said that SPCX will remain a high-quality stock worth holding long-term for a very long time to come. He also called on outsiders not to frame the matter as confrontation and said there is no need to deliberately create division.Earlier reports said that CZ, in a post replying to Musk's comment on Binance being hacked, stated: "I respect you very much, but now is not the time for jokes. Our SPCX stock (from our $500 million investment in your acquisition of Twitter) is now worth more than a billion dollars. I would be very grateful if you could show a little support."
Stonk posted that the StonkFun official website has now been restored. It was previously taken offline proactively due to a domain attack and migrated to new infrastructure. On-chain functions are now operating normally, and no users have been found to be affected so far. However, because DNS changes may take up to one hour to synchronize across some networks, users are advised to wait one hour before connecting their wallets through the official website.
StonkBrokers founder SimpleFarmer posted on X platform stating that the earlier security alert regarding StonkBroker suffering a StepDrainer front-end attack was a false alarm, and the malicious domain in question was not its official website. StonkBroker's official domain is StonkBrokers.io. Blockaid has removed StonkBroker from the affected list and deleted the previously published alert tweet, and the team has also taken the malicious domain offline.
He Yi responded on the X platform to the "inside job" allegations triggered by the Binance hack incident, stating that investing is often about judgment, a game of logic, and the ability to extract effective information by peeling back the layers. Regarding some users' concerns about Binance's solvency, He Yi said this is understandable, but Binance's trading volume, fees, user scale, and quarterly BNB burns are all public information.
Flap stated that the team is still investigating the root cause of the previous DNS attack and has not yet confirmed whether it is related to the domain service provider. To enhance security and platform stability, the official website has been migrated to flap.cool, and users are reminded to temporarily avoid accessing the old domain flap.sh or using it to connect wallets and sign transactions.
OKX founder Star addressed rumors of an OKX hack by stating they are false, noting that OKX has continuously invested in security infrastructure over the past 13 years.
Flap posted on X that the team is investigating whether the recent DNS attack is related to the domain service provider, and the specific cause has not yet been identified. Flap has migrated to the new domain flap.cool and reminds users not to visit flap.sh for now, or connect wallets or sign transactions on that domain; users visiting flap.sh will be redirected to the new domain.
Pons founder Ozzy posted on X platform that, according to a Blockaid warning, the StepDrainer attack previously targeting projects such as Kintsu and Flap is expanding and now involves StonkFun, Pickle Finance, Echelon, Origami, Fluxbeam, Stakepoint, SupSwap, Longbow, SHPRD, and ApeX DeFi. Blockaid reminds users to temporarily avoid visiting the above websites and the previously disclosed affected DApps, and not to connect their wallets.
World Liberty advisor Ogle posted on X platform stating that they received an alert from security firm Blockaid, warning users to temporarily avoid visiting the relevant websites or connecting wallets. According to the publicly disclosed alert information, Blockaid stated it has detected an active front-end attack related to the StepDrainer toolkit, involving Kintsu, Flap, and StonkBrokers. The affected sites have been injected with malicious scripts, and users who click "Connect Wallet" may be redirected to malicious asset-draining pages. Blockaid is currently investigating and gathering more information, with further updates to be announced.
Flap posted on X that its official website is currently experiencing a DNS hijacking and has been redirected to an unauthorized website. The team reminds users not to visit the official website, connect wallets, or sign any transactions for the time being, and states that they are working on the issue and will publish an update once the website is confirmed to be safe.
According to Hifi Finance monitoring, Hifi Finance has disclosed that Hifi DAO suffered a governance takeover attack, and HIFI token holders have effectively lost control of the protocol, the governance smart contracts, and the HIFI token supply. The team reminded all users with collateral deposited in Hifi Protocol to withdraw immediately, and specifically requested the controllers of two relevant addresses to withdraw WETH from the protocol. Hifi Finance stated that the core team failed to detect and stop the governance attack in time and takes full responsibility for it. The team has now taken measures to significantly limit the scope of the attack's impact. The final loss has not yet been determined, with a preliminary estimate of about $20,000. The DAO treasury is sufficiently funded and will compensate all affected parties; the DAO's own liquidity has been permanently withdrawn from decentralized trading platforms. In addition, all outstanding debt collateralized by RWAs will be managed directly by the core team and will no longer be processed through the compromised smart contracts. The relevant debt remains adequately capitalized and is expected to be repaid in full on the original maturity date of March 26, 2027, and the protocol will not issue new debt. The team said a full investigation report will be released later.
Odaily — According to on-chain analyst Ai Yi, an a16z-linked entity (0xb5E...F...) has been suspected of selling off $10.7 million worth of HYPE since yesterday. Following the disclosure of the Binance hack news, the entity transferred 118,000 HYPE in batches to Wintermute, Galaxy Digital, and Cumberland at an average price of $90.72, with the purpose unknown. The most recent transfer occurred 10 hours ago.
the Binance hack incident may present opportunities for decentralized exchanges (DEXs). Each time a major sudden security breach or trust crisis occurs at a large CEX, DEXs and the entire DeFi sector experience a significant inflow of capital and development opportunities, and this time is no exception. The advantage of DEXs is that their security is guaranteed by computer science and cryptography, making them immune to social engineering attacks that could lead to trojan implantation or system compromise. DEX on-chain hard rules are enforced automatically, such as time locks and automatic circuit breakers. Even if a hacker obtains keys, they must still comply with the rules set by the smart contracts.This security incident has once again sounded the alarm of "Not your keys, not your coins." A large number of users, concerned about the security of centralized custody, will withdraw assets to personal cold wallets or on-chain non-custodial wallets. Once assets flow back on-chain, the trading, liquidity mining, and wealth management needs of these idle funds will be directly absorbed by leading DEXs such as Uniswap and Jupiter, driving a short-term surge in DEX trading volume and total value locked (TVL). (Caixin)
According to Onchain Lens monitoring, the Binance hacker group is repeatedly splitting funds across multiple wallets through automated transfers, then moving them back to previous addresses and redistributing them to new addresses in order to obscure the fund flows. Most recently, the group transferred 120 million TRX, worth approximately $38.78 million, and subsequently carried out further distribution.
Privacy blockchain Iron Fish confirmed that recent anomalous activity involving wIRON and the ChainPort cross-chain bridge originated from an inflation vulnerability within its own blockchain, rather than an issue with the cross-chain bridge itself. The vulnerability traces back to the 2019 Merkle tree implementation, which could allow the same privacy note to be double-spent. The team has submitted a patch and plans to close and archive the code repository.