News linked to this event type.
On-chain detective ZachXBT, in response to a question on X regarding the identity of the attacker behind the Binance security incident, stated that the attacker may be the North Korean hacking group Lazarus Group.
Binance stated that preliminary investigations show the security incident may have been caused by a compromised computer belonging to a DevOps engineer, through which attackers submitted unauthorized withdrawals via service containers; the incident affected approximately $6.3 billion, with about $3 billion already frozen on-chain, and losses are covered by the SAFU fund and company funds.
Odaily Report: Binance has issued a security incident progress announcement stating that the preliminary investigation indicates the incident may have originated from the compromise of a DevOps engineer's laptop, through which attackers gained access to service containers and submitted unauthorized withdrawal transactions. No evidence of wallet private key leakage has been found so far, and a complete technical investigation report will be published after the investigation concludes.Binance stated that the incident is expected to cause losses of approximately $6.3 billion. The platform has already collaborated with blockchain partners to freeze approximately $3 billion in affected assets on-chain. The platform will cover all losses through the SAFU fund and the company's own capital, and will update its Proof of Reserves (PoR) after security remediation is completed.As an emergency response measure, Binance has temporarily suspended deposits and withdrawals, revoked authorizations for affected addresses, and is working with law enforcement agencies and blockchain intelligence partners to track and recover the stolen funds. Binance emphasized that user funds are safe, and the related investigation and recovery efforts are still ongoing.
Odaily reports: Jiang Zhuoer, founder of Litecoin Pool, posted on X platform that Binance's potential loss accounts for a limited proportion of user assets and is not expected to trigger a large-scale wave of withdrawals.He compared this situation with the Bybit theft incident in February 2025: Bybit was hacked for approximately $1.46 billion at the time, accounting for 9.01% of its approximately $16.2 billion in user assets; if Binance's gross outflow this time is $5.64 billion, of which $3 billion has been frozen, the net amount after deduction would be approximately $2.64 billion, accounting for 1.6% of its approximately $165.12 billion in user assets.In addition, the gross outflow may also include internal fund transfers by the platform and normal user withdrawals, and cannot all be regarded as stolen funds. Binance is capable of bearing the relevant losses.
Odaily reports: Crypto KOL Seven research posted that "right now, the vast majority of market makers and quantitative firms in the crypto market keep the bulk of their capital and main margin accounts on Binance. Many institutions engage in cross-exchange arbitrage or hedging, and Binance's suspension of withdrawals could cause their funding chains to seize up on the spot—if market volatility continues to intensify, they would be unable to withdraw funds from Binance to top up margin elsewhere. To avoid liquidation, they would be forced to close positions on other exchanges and on-chain, forcibly pulling cash back. This is also why, even though the assets stolen were Ethereum-ecosystem assets, Solana and a bunch of altcoins ended up crashing along with it today."
Binance.US CEO Steve Gregory stated that Binance.US user funds are entirely separate and unaffected by this incident. He also emphasized that Binance.US and Binance are completely independent entities, with no shared asset custody arrangements between them.
Odaily reports: According to Onchain Lens monitoring, the Binance hacker has begun selling STRK; two Hyperliquid traders hold STRK short positions with a combined unrealized profit of $4.46 million, of which one trader has an unrealized profit of $1.61 million and the other trader has an unrealized profit of $2.85 million.
According to official sources, in response to recent security incidents involving Bybit, Bitget, and Binance, OKX founder and CEO Star stated that security should not be an area of commercial competition, but rather a shared responsibility of the entire crypto industry. Over the past decade, major exchanges have made significant progress in private key protection, but potential risks remain in access control and wallet management systems. He emphasized that no system is absolutely secure, and any major security breach at any exchange could undermine trust in the entire industry.Star called on major exchanges in the crypto industry to strengthen cooperation and jointly establish stricter industry security standards and coordinated response mechanisms, including adding verification and security delays for large withdrawals to unknown addresses and smart contract authorization transactions, and implementing key security restrictions at the cryptographic signing layer. Meanwhile, the industry should establish real-time security incident reporting, joint monitoring of suspicious funds, and rapid response mechanisms, and promote collaborative research in areas such as quantum-resistant cryptography and AI-driven security threat defense. He emphasized that no single company can safeguard the future of the crypto industry alone.
Odaily reports: Liquid Capital founder Yi Lihua posted on X platform, stating: "We repeatedly called for a pullback every day, but never expected the strong support level of $79,000 to be broken by a black swan event. This was not part of the plan. The originally planned $75,000 and $71,000 levels need to be re-observed and adjusted due to changed circumstances. However, the end of the black swan impact and the midterm elections marks the arrival of the best opportunity to buy the dip."
OKX founder Star stated that following a series of security incidents at Bybit, Bitget, and Binance, he called on industry CEOs to join forces and establish stronger security standards and coordinated response mechanisms, including mandatory security restrictions at the signature layer, real-time incident reporting, and rapid freezing of stolen assets.
that, according to Onchain Lens monitoring, the hacker group allegedly linked to the $5.8 billion Binance attack is transferring over $1 billion worth of ETH to new wallets and may be preparing to launder the funds through Tornado and other mixers.
According to on-chain detective Specter, First Digital has blacklisted the attacker's address, which holds 3.4 million FDUSD.
SlowMist Chief Information Security Officer 23pds stated that, based on historical forensic experience, the one-time transfer of Binance's assets indicates the attacker successfully bypassed the risk control system. Whether the intrusion vector involved a leaked private key or compromised signing machines still requires priority verification. He personally leans toward the private key leakage hypothesis and believes the attacker most likely employed custom-built withdrawal tools. He advises security teams to prioritize investigating private key leak pathways and anomalies associated with unauthorized withdrawal tools during attribution and forensic investigations.
Odaily News: According to Lookonchain monitoring, after the Binance attacker completed the sell-off of all 217.5 million ENA (worth approximately $33.93 million), a newly created wallet address (0xedc0) began going long on ENA.The address deposited 2 million USDC into Hyperliquid, then opened a long position of 22.78 million ENA with 3x leverage, with the position value at approximately $4.09 million.
Odaily reports: An empirical study presented at USENIX Security 2026 shows that among the approximately 3.66 million early EIP-7702 authorization transactions across seven chains, about 63% were associated with malicious contracts; confirmed losses exceed $2.3 million, and 924 malicious contracts were identified. Most attacks use phishing to trick users into signing authorizations that delegate their wallets to sweeper contracts. On-chain analysis shows that in today's anomalous outflow event from Binance hot wallets, attackers exploited EIP-7702 authorizations signed by hot wallets including Binance 14 to delegate accounts to pre-deployed malicious sweeper contracts, then transferred assets in bulk within minutes. Estimates from multiple parties put the scale in the billions of dollars, and Tether, Circle, and others have frozen some stablecoins. This incident aligns with the risks identified in the research: whether through private key leakage or abuse of signing systems, once attackers obtain a legitimate authorization signature, EIP-7702 grants them persistent execution control over the account until the authorization is revoked.
Odaily reports: According to Lookonchain monitoring, after the Binance attack incident, a whale address 0x8add immediately shorted 22,047 ETH (approximately $48.89 million) and 620.7 BTC (approximately $47.89 million) at maximum leverage, with the two short positions totaling approximately $96.78 million in notional value. Currently, the trader's unrealized profit on these positions has reached $2.29 million.
Odaily Report: Derek Chiang, founder of ZeroDev and a developer involved with EIP-7702, posted on X stating that first, to be clear — EIP-7702 itself has no vulnerability. If you are using a wallet that supports EIP-7702 (MetaMask, Uniswap, Ambire, etc.), please do not panic.EIP-7702 is an Account Abstraction improvement proposal that allows externally owned accounts (EOAs) to sign a special message called a "7702 authorization," thereby embedding a smart contract into that account. This enables accounts to achieve powerful functionality, such as transaction batching — combining "authorization" and "transfer" into a single transaction, allowing you to complete a swap on Uniswap with just one click.Unfortunately, the same feature also allows hackers to efficiently transfer all your tokens in a single transaction. In the Binance hack incident, the hacker moved ETH, USDT, and 62 other tokens in one transaction, whereas without EIP-7702, they would have needed to send a separate transaction for each token. In this particular incident, many such transactions would have failed anyway, because Binance was still using the compromised wallet for withdrawals at the time, so all transactions sent by the hacker had to compete with legitimate transactions for Nonce (transaction sequence number). Therefore, using EIP-7702 did help the hacker steal funds as quickly and as extensively as possible.However, for the hacker to use EIP-7702, one of the following conditions must have been met: first, they obtained the private key; second, they tricked Binance into signing a 7702 authorization — the latter is highly unlikely, as it is hard to imagine Binance exposing an endpoint used for signing 7702 authorizations (or worse, signing raw messages that could be repackaged by the hacker for 7702 authorization). But until the official postmortem report is released, this possibility cannot be completely ruled out.Derek Chiang added: "As one of the contributors to account abstraction, I feel somewhat responsible for this hack incident, because while giving accounts more powerful functionality, we have indeed also given hackers stronger capabilities."
Odaily reports: According to monitoring by on-chain analyst Ai Yi, the UXLINK hacker-linked address (0xde8...9524) opened a 30,282.4 ETH long position on Hyperliquid. Its unrealized profit reached $7.422 million in the early hours of today, but has now narrowed to $2.45 million. The original post stated that ETH came under pressure and pulled back due to the recent Binance hack incident.
Odaily Report: LlamaRisk posted on the governance forum stating that after the attack on Binance's Ethereum hot wallet, LlamaRisk, Aave Labs, and others decided to have the guardian freeze markets across the network, freezing a total of 175 reserve types across 16 networks covered by Aave V3, as well as 117 reserves across four spoke categories in Aave V4. Aave will continue to monitor the attacker's wallets and price feeds, and once fund flows cease, it will coordinate with all parties to unfreeze in phases.
Odaily reports: According to Lookonchain monitoring, the Binance attacker has completed the sell-off of 7 tokens including UNI, ENA, PEPE, LINK, AAVE, ONDO, and WLD, cumulatively converting to 70,480 ETH, valued at approximately $158.25 million based on current quoted prices. Among them:UNI: sold 7.02 million tokens, worth $39.63 million, at an average price of $5.65;ENA: sold 217.5 million tokens, worth $33.93 million, at an average price of $0.16;PEPE: sold 7.77 trillion tokens, worth $31.66 million, at an average price of $0.0000041;LINK: sold 2.57 million tokens, worth $26.05 million, at an average price of $10.14;AAVE: sold 127,953 tokens, worth $14.27 million, at an average price of $111.55;ONDO: sold 21.85 million tokens, worth $6.62 million, at an average price of $0.30;WLD: sold 17.32 million tokens, worth $6.09 million, at an average price of $0.35.