News linked to this event type.
1inch stated that it has been tracking the Binance security incident and proactively reached out to Binance to provide support. Its risk management team, in collaboration with ZeroShadow, SEAL 911, TRM Labs, and other entities, has already blocked addresses associated with the attack from the 1inch dApp, 1inch Wallet, and 1inch API within the first hour after the incident, and will continue to update the list as new addresses are identified.
ZachXBT stated that approximately 45 minutes ago, the stolen funds from the $6.3 billion Binance hack and the $388 million Bitget hack were transferred via THORChain and pooled into a single on-chain address. This flow of funds indicates that both incidents may have been carried out by the same attacker. ZachXBT pointed out that the Bitget attack was previously attributed to the North Korea-affiliated hacker group TraiderTraitor, which is also connected to earlier attacks, including those on Kelp DAO.
Odaily reports: On-chain detective ZachXBT posted on X that approximately 45 minutes ago, stolen funds from the $6.3 billion Binance security incident and the $388 million Bitget security incident flowed through THORChain into the same address and were mixed, indicating that both incidents were likely carried out by the same attacker.ZachXBT noted that the Bitget attack had previously been attributed to the North Korea-linked hacking group TraiderTraitor, which has also been linked to other security incidents such as Kelp DAO.
Odaily Report: According to monitoring by on-chain analyst Yu Jin, whale wenyu8888888 (0x79E...8bcAd) bought UNI and PEPE this morning after the hacker's sell-off triggered a panic-driven market decline. At around 7 AM, the address spent $2.61 million to buy 297.9 billion PEPE and 208,000 UNI. Twenty minutes ago, all of these UNI and PEPE were transferred to Gate, worth $2.88 million. The trade took 5 hours and generated a profit of $270,000.
A vulnerability analysis published by the GoPlus Chinese community reported that on October 29 (UTC), a user asset theft incident occurred on the Polymarket international site. The RUM script of the third-party performance monitoring provider DebugBear was compromised via a supply chain attack, with malicious code injected into user pages to abuse trading and signing permissions for asset transfers.
According to monitoring by SlowMist's Cos, funds from the Binance hacker have been linked to wallet addresses associated with the hackers behind the Phemex exploit in early 2025. SlowMist's Cos stated that the incident was determined at the time to involve North Korean hackers.
Odaily report: Crypto KOL "土澳大狮兄" posted on X platform, stating that there are increasingly fewer mixing channels capable of handling large sums of Bitcoin, and most centralized exchanges now require strict KYC and will cooperate to freeze funds. Combined with increasingly mature on-chain tracking, the difficulty for hackers to move and liquidate stolen funds has significantly increased.Even if the 18,270 BTC stolen from Binance (worth approximately $1.4 billion) can be laundered, it will be very slow, may require substantial discounts, and carries a higher risk of being intercepted along the way—making it unlikely to become selling pressure in the short term.Additionally, Binance co-founder Yi He replied under the tweet, saying, "We will chase this to the end."
community users noticed Kraken experienced a period earlier where trading or withdrawals were unavailable.Kraken officially posted at 10:42 announcing: "We are investigating an issue affecting spot and derivatives clients connecting to the platform and submitting orders through all web, mobile applications, and REST and WebSocket connections. We are working to resolve the issue and will provide updates as more information becomes available."At 11:42, Kraken posted another update on progress, stating the issue had been resolved.OneKey founder Yishi commented on the matter: "Looks like Kraken had an issue just now too. Trading and withdrawals were unavailable, and the entire exchange went into 'post-only' mode. It's recovered now, but it really gave me a scare. Right now, attacking is far easier than defending. We must devote all our efforts to security. Full 'fortress mode' engaged."
According to Lookonchain monitoring, the Pando Rings hacker (0x303D...3d9F) bought 7,548 ETH worth $16.72 million 2 hours ago.
Du Jun posted on X: "Family offices that I persuaded years ago to allocate BTC and ETH, after experiencing centralized exchange hacks and cold wallet supply chain security incidents, have one after another swapped their BTC for IBIT, and some simply sold their coins to buy physical gold and other traditional assets. I don't even know how to advise them anymore—it seems there's no solution."
According to TechFlow, 37 crypto theft cases linked to Lazarus and North Korean-affiliated hackers occurred between 2017 and 2026, with a reported aggregate valuation of approximately $11.817 billion, and the latest Binance incident alone accounting for roughly $6.3 billion in total impact.
Odaily reports: According to on-chain analyst Aunt Ai's monitoring, the Kanye-associated address (0xdea6...1d5c) began selling 1,390 ETH in batches six hours ago (after news of the Binance hack was disclosed), at an average price of $2,275.6, with a sale value of $3.163 million and a loss of $317,000; it is currently still staking 19,506.17 ETH and has borrowed $27.67 million in stablecoins, with a health score of 1.31. A drop in ETH to $1,689.59 will trigger liquidation.
Musk shared reports on the Binance hacking incident and commented, “Everyday is Zeroday.” Zero-day (zero-day vulnerability) is a technical term in cybersecurity, referring to security flaws in software, systems, or hardware for which developers or vendors do not yet have an available patch, allowing attackers to exploit them. It is called zero-day because when a vendor discovers or learns of the vulnerability, they have zero days to implement a fix in advance.
Odaily reports: According to on-chain analyst The Data Nerd, the Binance hacker has sold altcoins worth approximately $158.25 million and converted all proceeds into 70,480 ETH.The specific sell-offs include: 7.02 million UNI (approximately $39.63 million), 217.5 million ENA (approximately $33.93 million), 7.77 trillion PEPE (approximately $31.66 million), 2.57 million LINK (approximately $26.05 million), 127,953 AAVE (approximately $14.27 million), 21.85 million ONDO (approximately $6.62 million), and 17.32 million WLD (approximately $6.09 million).Currently, all of the aforementioned altcoins held by the relevant address have been fully liquidated.
Odaily reports: Binance founder CZ posted on X that user funds are safe (SAFU), and specifically mentioned that He Yi, despite being pregnant, stayed up all night with hundreds of Binance employees to handle this security incident.CZ stated that many industry friends and even competitors, including peers with whom relations had previously not been friendly, offered much-needed help. He admitted that this incident is deeply painful, but emphasized that Binance will get through it.
According to The Sandbox monitoring, it is aware of the attack incident affecting Binance and is working closely with the Binance team. SAND in user self-custody wallets is unaffected; for SAND held on Binance, please follow Binance's official updates.
USDT0 official announced that transfer services between Ethereum and TRON have now resumed. The prior suspension of related services was implemented as a precautionary measure to prevent the transfer of stolen funds. USDT0 thanked users for their patience, noting that its infrastructure remains unaffected and continues to operate securely.
On-chain detective ZachXBT stated on the X platform when responding to questions about the identity of the attackers in the Binance security incident that the attackers may be the North Korean hacker group Lazarus Group.
On-chain detective ZachXBT, in response to a question on X regarding the identity of the attacker behind the Binance security incident, stated that the attacker may be the North Korean hacking group Lazarus Group.
Binance stated that preliminary investigations show the security incident may have been caused by a compromised computer belonging to a DevOps engineer, through which attackers submitted unauthorized withdrawals via service containers; the incident affected approximately $6.3 billion, with about $3 billion already frozen on-chain, and losses are covered by the SAFU fund and company funds.