News linked to both this project and an event.
ZachXBT stated that approximately 45 minutes ago, the stolen funds from the $6.3 billion Binance hack and the $388 million Bitget hack were transferred via THORChain and pooled into a single on-chain address. This flow of funds indicates that both incidents may have been carried out by the same attacker. ZachXBT pointed out that the Bitget attack was previously attributed to the North Korea-affiliated hacker group TraiderTraitor, which is also connected to earlier attacks, including those on Kelp DAO.
Odaily reports: On-chain detective ZachXBT posted on X that approximately 45 minutes ago, stolen funds from the $6.3 billion Binance security incident and the $388 million Bitget security incident flowed through THORChain into the same address and were mixed, indicating that both incidents were likely carried out by the same attacker.ZachXBT noted that the Bitget attack had previously been attributed to the North Korea-linked hacking group TraiderTraitor, which has also been linked to other security incidents such as Kelp DAO.
He Yi stated on the X platform that the platform's deposit services are currently unaffected and still operating normally. The Binance team is improving withdrawal services and related address control features, and withdrawal services are expected to resume within the next 48 hours. Further updates will be announced through Binance's official channels.
Odaily reports: According to on-chain analyst Aunt Ai's monitoring, the Kanye-associated address (0xdea6...1d5c) began selling 1,390 ETH in batches six hours ago (after news of the Binance hack was disclosed), at an average price of $2,275.6, with a sale value of $3.163 million and a loss of $317,000; it is currently still staking 19,506.17 ETH and has borrowed $27.67 million in stablecoins, with a health score of 1.31. A drop in ETH to $1,689.59 will trigger liquidation.
Odaily reports: According to on-chain analyst The Data Nerd, the Binance hacker has sold altcoins worth approximately $158.25 million and converted all proceeds into 70,480 ETH.The specific sell-offs include: 7.02 million UNI (approximately $39.63 million), 217.5 million ENA (approximately $33.93 million), 7.77 trillion PEPE (approximately $31.66 million), 2.57 million LINK (approximately $26.05 million), 127,953 AAVE (approximately $14.27 million), 21.85 million ONDO (approximately $6.62 million), and 17.32 million WLD (approximately $6.09 million).Currently, all of the aforementioned altcoins held by the relevant address have been fully liquidated.
Binance stated that preliminary investigations show the security incident may have been caused by a compromised computer belonging to a DevOps engineer, through which attackers submitted unauthorized withdrawals via service containers; the incident affected approximately $6.3 billion, with about $3 billion already frozen on-chain, and losses are covered by the SAFU fund and company funds.
Odaily Report: Binance has issued a security incident progress announcement stating that the preliminary investigation indicates the incident may have originated from the compromise of a DevOps engineer's laptop, through which attackers gained access to service containers and submitted unauthorized withdrawal transactions. No evidence of wallet private key leakage has been found so far, and a complete technical investigation report will be published after the investigation concludes.Binance stated that the incident is expected to cause losses of approximately $6.3 billion. The platform has already collaborated with blockchain partners to freeze approximately $3 billion in affected assets on-chain. The platform will cover all losses through the SAFU fund and the company's own capital, and will update its Proof of Reserves (PoR) after security remediation is completed.As an emergency response measure, Binance has temporarily suspended deposits and withdrawals, revoked authorizations for affected addresses, and is working with law enforcement agencies and blockchain intelligence partners to track and recover the stolen funds. Binance emphasized that user funds are safe, and the related investigation and recovery efforts are still ongoing.
Odaily reports: Jiang Zhuoer, founder of Litecoin Pool, posted on X platform that Binance's potential loss accounts for a limited proportion of user assets and is not expected to trigger a large-scale wave of withdrawals.He compared this situation with the Bybit theft incident in February 2025: Bybit was hacked for approximately $1.46 billion at the time, accounting for 9.01% of its approximately $16.2 billion in user assets; if Binance's gross outflow this time is $5.64 billion, of which $3 billion has been frozen, the net amount after deduction would be approximately $2.64 billion, accounting for 1.6% of its approximately $165.12 billion in user assets.In addition, the gross outflow may also include internal fund transfers by the platform and normal user withdrawals, and cannot all be regarded as stolen funds. Binance is capable of bearing the relevant losses.
Odaily reports: Crypto KOL Seven research posted that "right now, the vast majority of market makers and quantitative firms in the crypto market keep the bulk of their capital and main margin accounts on Binance. Many institutions engage in cross-exchange arbitrage or hedging, and Binance's suspension of withdrawals could cause their funding chains to seize up on the spot—if market volatility continues to intensify, they would be unable to withdraw funds from Binance to top up margin elsewhere. To avoid liquidation, they would be forced to close positions on other exchanges and on-chain, forcibly pulling cash back. This is also why, even though the assets stolen were Ethereum-ecosystem assets, Solana and a bunch of altcoins ended up crashing along with it today."
Odaily reports: According to Onchain Lens monitoring, the Binance hacker has begun selling STRK; two Hyperliquid traders hold STRK short positions with a combined unrealized profit of $4.46 million, of which one trader has an unrealized profit of $1.61 million and the other trader has an unrealized profit of $2.85 million.
According to official sources, in response to recent security incidents involving Bybit, Bitget, and Binance, OKX founder and CEO Star stated that security should not be an area of commercial competition, but rather a shared responsibility of the entire crypto industry. Over the past decade, major exchanges have made significant progress in private key protection, but potential risks remain in access control and wallet management systems. He emphasized that no system is absolutely secure, and any major security breach at any exchange could undermine trust in the entire industry.Star called on major exchanges in the crypto industry to strengthen cooperation and jointly establish stricter industry security standards and coordinated response mechanisms, including adding verification and security delays for large withdrawals to unknown addresses and smart contract authorization transactions, and implementing key security restrictions at the cryptographic signing layer. Meanwhile, the industry should establish real-time security incident reporting, joint monitoring of suspicious funds, and rapid response mechanisms, and promote collaborative research in areas such as quantum-resistant cryptography and AI-driven security threat defense. He emphasized that no single company can safeguard the future of the crypto industry alone.
Odaily News: According to Lookonchain monitoring, after the Binance attacker completed the sell-off of all 217.5 million ENA (worth approximately $33.93 million), a newly created wallet address (0xedc0) began going long on ENA.The address deposited 2 million USDC into Hyperliquid, then opened a long position of 22.78 million ENA with 3x leverage, with the position value at approximately $4.09 million.
Odaily reports: Binance has stated that it will bear all losses caused by this incident. As a precautionary measure, the platform has temporarily suspended all deposit and withdrawal services so that the team can conduct security checks, freeze related funds, and cooperate with law enforcement investigations.Binance says its team is working around the clock to handle this incident and will publish a full post-mortem report once the investigation is complete. It also reminds users to obtain the latest updates on the incident only through Binance's official channels.
Odaily reports: An empirical study presented at USENIX Security 2026 shows that among the approximately 3.66 million early EIP-7702 authorization transactions across seven chains, about 63% were associated with malicious contracts; confirmed losses exceed $2.3 million, and 924 malicious contracts were identified. Most attacks use phishing to trick users into signing authorizations that delegate their wallets to sweeper contracts. On-chain analysis shows that in today's anomalous outflow event from Binance hot wallets, attackers exploited EIP-7702 authorizations signed by hot wallets including Binance 14 to delegate accounts to pre-deployed malicious sweeper contracts, then transferred assets in bulk within minutes. Estimates from multiple parties put the scale in the billions of dollars, and Tether, Circle, and others have frozen some stablecoins. This incident aligns with the risks identified in the research: whether through private key leakage or abuse of signing systems, once attackers obtain a legitimate authorization signature, EIP-7702 grants them persistent execution control over the account until the authorization is revoked.
Odaily reports: According to Lookonchain monitoring, after the Binance attack incident, a whale address 0x8add immediately shorted 22,047 ETH (approximately $48.89 million) and 620.7 BTC (approximately $47.89 million) at maximum leverage, with the two short positions totaling approximately $96.78 million in notional value. Currently, the trader's unrealized profit on these positions has reached $2.29 million.
Odaily Report: Derek Chiang, founder of ZeroDev and a developer involved with EIP-7702, posted on X stating that first, to be clear — EIP-7702 itself has no vulnerability. If you are using a wallet that supports EIP-7702 (MetaMask, Uniswap, Ambire, etc.), please do not panic.EIP-7702 is an Account Abstraction improvement proposal that allows externally owned accounts (EOAs) to sign a special message called a "7702 authorization," thereby embedding a smart contract into that account. This enables accounts to achieve powerful functionality, such as transaction batching — combining "authorization" and "transfer" into a single transaction, allowing you to complete a swap on Uniswap with just one click.Unfortunately, the same feature also allows hackers to efficiently transfer all your tokens in a single transaction. In the Binance hack incident, the hacker moved ETH, USDT, and 62 other tokens in one transaction, whereas without EIP-7702, they would have needed to send a separate transaction for each token. In this particular incident, many such transactions would have failed anyway, because Binance was still using the compromised wallet for withdrawals at the time, so all transactions sent by the hacker had to compete with legitimate transactions for Nonce (transaction sequence number). Therefore, using EIP-7702 did help the hacker steal funds as quickly and as extensively as possible.However, for the hacker to use EIP-7702, one of the following conditions must have been met: first, they obtained the private key; second, they tricked Binance into signing a 7702 authorization — the latter is highly unlikely, as it is hard to imagine Binance exposing an endpoint used for signing 7702 authorizations (or worse, signing raw messages that could be repackaged by the hacker for 7702 authorization). But until the official postmortem report is released, this possibility cannot be completely ruled out.Derek Chiang added: "As one of the contributors to account abstraction, I feel somewhat responsible for this hack incident, because while giving accounts more powerful functionality, we have indeed also given hackers stronger capabilities."
Odaily reports: According to monitoring by on-chain analyst Ai Yi, the UXLINK hacker-linked address (0xde8...9524) opened a 30,282.4 ETH long position on Hyperliquid. Its unrealized profit reached $7.422 million in the early hours of today, but has now narrowed to $2.45 million. The original post stated that ETH came under pressure and pulled back due to the recent Binance hack incident.
Odaily reports: According to Lookonchain monitoring, the Binance attacker has completed the sell-off of 7 tokens including UNI, ENA, PEPE, LINK, AAVE, ONDO, and WLD, cumulatively converting to 70,480 ETH, valued at approximately $158.25 million based on current quoted prices. Among them:UNI: sold 7.02 million tokens, worth $39.63 million, at an average price of $5.65;ENA: sold 217.5 million tokens, worth $33.93 million, at an average price of $0.16;PEPE: sold 7.77 trillion tokens, worth $31.66 million, at an average price of $0.0000041;LINK: sold 2.57 million tokens, worth $26.05 million, at an average price of $10.14;AAVE: sold 127,953 tokens, worth $14.27 million, at an average price of $111.55;ONDO: sold 21.85 million tokens, worth $6.62 million, at an average price of $0.30;WLD: sold 17.32 million tokens, worth $6.09 million, at an average price of $0.35.
Odaily Report: According to monitoring by Benson Sun, Coinkarma founder Benson Sun posted that in Binance's recent theft incident, the exchange has confirmed the freezing of approximately $2.5 billion in assets, accounting for about half of the total stolen amount, with the remaining assets primarily consisting of Bitcoin and ETH. The stolen Bitcoin is worth approximately over $1 billion, but Bitcoin lacks deep mixing pools similar to Tornado Cash, and the relevant addresses will be flagged by trading platforms and on-chain analytics firms, making it far more difficult to liquidate than ETH. Reviewing cases such as the 2016 Bitfinex stolen Bitcoin that remained untouched for years, and the approximately 1,800 BTC stolen from Coldcard in July this year with 90% still unmoved as of early September, Benson Sun stated that this theft is larger in scale, and splitting addresses, mixing coins, and then discounting through OTC trading could take years, with short-term selling pressure nearly zero. If Binance uses SAFU to compensate and replenish Bitcoin, it could instead create buying pressure. In contrast, large amounts of ERC-20 tokens converted into ETH and then deposited into Tornado Cash are harder to trace, and the amount that could genuinely translate into market selling pressure may be in the range of over $1 billion. Benson Sun believes that market confidence will be impacted, but the direct selling pressure on Bitcoin is not as large as imagined, and called on the industry to seriously address security arrangements for hot wallet management, signature authorization, and quantum resistance in the post-AI era.
Odaily — According to on-chain analyst Aunt Ai, 30 minutes ago, the Binance hot wallet hacker transferred all 74.56 million ARB to address 0x000...0DA0. Arkham has tagged this address as Kelp DAO Hacker, and these tokens have not yet been moved or sold. Kelp DAO suffered an attack on April 18 this year, losing approximately $292 million in rsETH, and at the time the community speculated that the attacker was the North Korean hacker group Lazarus Group.