News linked to both this project and an event.
Odaily reports: An empirical study presented at USENIX Security 2026 shows that among the approximately 3.66 million early EIP-7702 authorization transactions across seven chains, about 63% were associated with malicious contracts; confirmed losses exceed $2.3 million, and 924 malicious contracts were identified. Most attacks use phishing to trick users into signing authorizations that delegate their wallets to sweeper contracts. On-chain analysis shows that in today's anomalous outflow event from Binance hot wallets, attackers exploited EIP-7702 authorizations signed by hot wallets including Binance 14 to delegate accounts to pre-deployed malicious sweeper contracts, then transferred assets in bulk within minutes. Estimates from multiple parties put the scale in the billions of dollars, and Tether, Circle, and others have frozen some stablecoins. This incident aligns with the risks identified in the research: whether through private key leakage or abuse of signing systems, once attackers obtain a legitimate authorization signature, EIP-7702 grants them persistent execution control over the account until the authorization is revoked.
Brian Armstrong posted on X that his team is doing its best to provide support, including intercepting transfers to the compromised wallets, and has contacted Binance to offer assistance. He stated that the industry should jointly address the current situation, publicly share useful information, and protect customers; the crypto industry has gone through many difficult periods and has emerged stronger each time, and this time will be no exception.
Odaily Report: Derek Chiang, founder of ZeroDev and a developer involved with EIP-7702, posted on X stating that first, to be clear — EIP-7702 itself has no vulnerability. If you are using a wallet that supports EIP-7702 (MetaMask, Uniswap, Ambire, etc.), please do not panic.EIP-7702 is an Account Abstraction improvement proposal that allows externally owned accounts (EOAs) to sign a special message called a "7702 authorization," thereby embedding a smart contract into that account. This enables accounts to achieve powerful functionality, such as transaction batching — combining "authorization" and "transfer" into a single transaction, allowing you to complete a swap on Uniswap with just one click.Unfortunately, the same feature also allows hackers to efficiently transfer all your tokens in a single transaction. In the Binance hack incident, the hacker moved ETH, USDT, and 62 other tokens in one transaction, whereas without EIP-7702, they would have needed to send a separate transaction for each token. In this particular incident, many such transactions would have failed anyway, because Binance was still using the compromised wallet for withdrawals at the time, so all transactions sent by the hacker had to compete with legitimate transactions for Nonce (transaction sequence number). Therefore, using EIP-7702 did help the hacker steal funds as quickly and as extensively as possible.However, for the hacker to use EIP-7702, one of the following conditions must have been met: first, they obtained the private key; second, they tricked Binance into signing a 7702 authorization — the latter is highly unlikely, as it is hard to imagine Binance exposing an endpoint used for signing 7702 authorizations (or worse, signing raw messages that could be repackaged by the hacker for 7702 authorization). But until the official postmortem report is released, this possibility cannot be completely ruled out.Derek Chiang added: "As one of the contributors to account abstraction, I feel somewhat responsible for this hack incident, because while giving accounts more powerful functionality, we have indeed also given hackers stronger capabilities."
Odaily Report: During the Binance attack, an obvious arbitrage opportunity emerged on-chain. According to a community user's review, the attacker, in order to avoid Tether freezing, swapped a large amount of USDT for ETH through DEXs, causing the ETH price on Uniswap to briefly rise to $2,560–$2,750, with some individual trades exceeding $3,000, while Aave's ETH price obtained through the Chainlink oracle remained at $2,250–$2,290. A price gap of 15% to 30% appeared between on-chain and oracle prices, lasting nearly an hour.Arbitrageurs exploited this price gap by depositing USDC/USDT as collateral into Aave, borrowing ETH at the oracle price, then selling it at high prices on DEXs, and buying back ETH to repay the loans once the spread narrowed. According to the user's statistics, within 6 hours after the incident, a total of 61 addresses borrowed ETH on Aave mainnet (excluding the hacker's address). Among them, the most profitable address sold 12,289 ETH at an average price of approximately $2,580, then bought back 12,314 ETH at an average price of approximately $2,297, earning about $3.47 million. The top ten arbitrage addresses collectively profited approximately $6.36 million.The user stated that the arbitrageurs exploited the price disconnection between centralized exchanges and DEXs, and that the Aave contract itself had no vulnerability. As DEX prices fell back and Aave froze the mainnet V3 market, the arbitrage window gradually closed. The above profits are based on transaction-by-transaction on-chain statistics and have not yet deducted Gas fees.
Binance has posted an update on the handling of the theft incident, stating that the total amount of assets confirmed frozen is approximately $3 billion. The Binance team continues to work closely with law enforcement agencies, asset issuers, blockchain intelligence firms, and industry partners to trace and freeze more assets.Binance stated that it will only publish verified data going forward, and will further update progress as more information is confirmed, while emphasizing the safety of user funds.
Circle CEO Jeremy Allaire stated that Circle is closely monitoring reports of a potential attack on Binance, and has coordinated with law enforcement to freeze over 800 million USDC related to the incident. Circle will continue to support the investigation.
Cobo co-founder Shenyu released a video analyzing the Binance theft from an on-chain transaction perspective. At 4:20 AM, the attacker broadcast a transaction containing 50 authorization requests signed with Binance's hot wallet private key, and began batch-transferring assets approximately three minutes later. Shenyu noted that the attack utilized the EIP-7702 authorization mechanism; the attacker had prepared a transfer list covering 64 tokens in advance and conducted two test runs using a test wallet, with the final run occurring roughly 3.5 hours before the main operation. The attacker subsequently transferred assets through multiple wallets and smart contract wallets, exchanging portions of stablecoins such as USDT for ETH to evade issuer-initiated freezes.
Odaily Report: Marc Zeller, founder of the Aave Chan Initiative (ACI), posted on X stating that the Aave protocol is fine.The Binance hacker injected 60 million USDT into the protocol within just 3 minutes and borrowed 19,762 wETH (approximately $44.9 million), at which point Tether had not yet frozen the address, nor had the Aave Guardian frozen the Aave V3 Core pool's reserves (this operation occurred 46 minutes later).However, USDT is backed by real dollars, and from the protocol's perspective, although this position is the proceeds of crime, it is overcollateralized — with a health factor of 1.04, holding $59.9 million in collateral against $44.9 million in debt.Of course, the protocol now has a large borrower with little incentive to repay the loan, but the liquidation mechanism will still operate as usual. If the ETH price rises above approximately $2,365 (+4%), the position will be liquidated just like any other position.Currently, the Aave V3 Core pool's total wETH reserves stand at 2.16 million wETH, and the hacker's debt accounts for "only" 0.9% of that, so Aave does not need to take any special action against the hacker. There are currently 345,000 wETH available (capital utilization rate of 81.6%), so if wETH depositors wish to withdraw, liquidity is fully sufficient. There is no reason or need for a bank run to occur.This situation is far less alarming than the Kelp hacker incident (which involved zero-value collateral). In theory, a governance proposal could be passed to force liquidation of the hacker by upgrading the pool (if the USDT liquidation threshold were lowered, it would affect all USDT depositors), but there is no practical benefit to doing so, as the normal liquidation mechanism can easily absorb this debt.
Bybit founder and CEO Ben Zhou stated that reports of security incidents at multiple platforms are circulating on social media. Bybit has not been affected in any way, its systems are operating normally, trading and withdrawal functions remain available, and user assets are secure. Bybit is willing to provide support to Binance in multiple areas.
Binance officially announced on X: "We have noticed that various different figures regarding the frozen amount are currently circulating publicly, including claims referencing $1.8 billion. To clarify the facts, the total verified frozen amount is currently $2.54 billion. This figure may continue to increase as our team works closely with law enforcement agencies, issuers, blockchain intelligence firms, and industry partners to trace and freeze more assets. We will only share confirmed figures and will provide further updates as we obtain more verified information."
Binance posted on X that, as part of ongoing security measures, it has temporarily suspended Binance Alpha trading. Binance stated that trading will resume once the security issue is resolved, user funds are safe, and it will continue to publish related updates.
Odaily report: A wallet suspected to be associated with the Binance hack incident received tens of thousands of ETH through a Uniswap contract and borrowed 19,762 ETH on Aave using approximately $60 million in USDT as collateral. On-chain records do not show any vulnerabilities in Uniswap or Aave.As of 22:07 UTC, the two wallets held approximately 253,000 ETH, worth about $570 million, with no outgoing transfers recorded. Aave has paused the Ethereum mainnet V3 market, and Kamino has also paused borrowing in the SOL/BTC market; Ripple has frozen approximately $200 million in RLUSD, and more than $2 billion in USDT and USDC has been frozen by stablecoin issuers. (Decrypt)
Blockaid stated that the attacker batch-submitted 50 EIP-7702 authorizations in a single transaction to hit Binance's hot wallet real-time nonce; only one succeeded, after which the wallet was subsequently upgraded to a receiving contract. The associated address also transferred out approximately $37.48 million worth of PEPE.
Odaily Report: He Yi responded on X to a suspected Binance hacking incident, with the following statement:We have noticed reports regarding a potential security issue and are actively investigating.Our security team is urgently reviewing all relevant information. Once verified, we will immediately release the latest updates through Binance's official channels. Users should be wary of scams and must not trust unofficial links, messages, or requests for account information.
According to an official announcement from Cysic, following the cross-chain bridge security incident that occurred earlier, Cysic has fully resumed its cross-chain bridge services, and users can now once again transfer CYS across chains between the Cysic mainnet and other supported blockchains. Additionally, Cysic has permanently burned 7,200,002 CYS on the BNB Smart Chain and confirmed that this operation has been recorded on-chain.
According to an official announcement, Binance will list Predict (PREDICT) on October 30, 2026 at 18:00 (UTC+8).
According to Binance Wallet, the PREDICT token Alpha launch and trading time is set for October 30, 2026, at 17:00.Users who have claimed Prime Sale Keys can immediately view their balance on Binance Alpha and begin trading the PREDICT token once it goes live.
Binance Wallet officially announced that the Predict.fun (PREDICT) token will soon begin circulating and will be listed for trading on Binance Alpha on October 30 at 17:00 (UTC+8). Users who have claimed a Prime Sale Key can view their PREDICT balance in advance and trade via Binance Alpha once the token officially goes live.
research firm Decentralised.co (DCo) has released a report stating that the share of non-crypto asset trading volume on Hyperliquid rose from zero in September 2025 to a peak of 51% in July 2026, and stood at approximately 30% in October 2026; on October 27, such trading accounted for 40% of the platform's $7.2 billion in daily trading volume, with single stocks being the largest trading category that day.The report uses a 2029 global futures and equities market size of $934 trillion as its base, with the base-case scenario assuming crypto trading volume grows to 3 times the current level, a 3% share of the non-crypto market, a blended fee rate of 0.006%, USDC yield falling to 3.6%, and HIP-4 contributing $100 million in revenue; on this basis, it estimates that 2029 revenue will rise from $944 million to $4.91 billion, corresponding to an HYPE price of $128 at a 40x valuation, $98 at a 30x valuation, and $165 under the optimistic scenario, with the current HYPE price at approximately $77. The report states that if the non-crypto fee rate falls to CME's 0.0004%, the base valuation would drop to $66; Binance has already listed 229 TradFi perpetual contracts this year, with average daily trading volume of $13.4 billion, higher than Hyperliquid's $2.3 billion.
According to an official Binance announcement, Binance US stock trading services will be suspended from 20:50 to 22:30 UTC on October 31, 2026 (04:50 to 06:30 Beijing Time on November 1) due to scheduled system upgrades by its partner broker. During this period, users will be unable to submit stock trading orders. The upgrade is scheduled outside regular U.S. stock market trading hours, and the downtime is not expected to exceed the planned window but may conclude earlier or be extended due to additional work. Services will automatically resume upon completion of the upgrade.