News linked to both this project and an event.
According to Arkham's monitoring, Binance hackers just transferred $38.82 million worth of ETH to a new wallet, possibly preparing to deposit it into Tornado Cash. The wallet still holds $1.12 billion in ETH.
1inch stated that it has been tracking the Binance security incident and proactively reached out to Binance to provide support. Its risk management team, in collaboration with ZeroShadow, SEAL 911, TRM Labs, and other entities, has already blocked addresses associated with the attack from the 1inch dApp, 1inch Wallet, and 1inch API within the first hour after the incident, and will continue to update the list as new addresses are identified.
ZachXBT stated that approximately 45 minutes ago, the stolen funds from the $6.3 billion Binance hack and the $388 million Bitget hack were transferred via THORChain and pooled into a single on-chain address. This flow of funds indicates that both incidents may have been carried out by the same attacker. ZachXBT pointed out that the Bitget attack was previously attributed to the North Korea-affiliated hacker group TraiderTraitor, which is also connected to earlier attacks, including those on Kelp DAO.
Odaily reports: On-chain detective ZachXBT posted on X that approximately 45 minutes ago, stolen funds from the $6.3 billion Binance security incident and the $388 million Bitget security incident flowed through THORChain into the same address and were mixed, indicating that both incidents were likely carried out by the same attacker.ZachXBT noted that the Bitget attack had previously been attributed to the North Korea-linked hacking group TraiderTraitor, which has also been linked to other security incidents such as Kelp DAO.
According to monitoring by SlowMist's Cos, funds from the Binance hacker have been linked to wallet addresses associated with the hackers behind the Phemex exploit in early 2025. SlowMist's Cos stated that the incident was determined at the time to involve North Korean hackers.
Odaily report: Crypto KOL "土澳大狮兄" posted on X platform, stating that there are increasingly fewer mixing channels capable of handling large sums of Bitcoin, and most centralized exchanges now require strict KYC and will cooperate to freeze funds. Combined with increasingly mature on-chain tracking, the difficulty for hackers to move and liquidate stolen funds has significantly increased.Even if the 18,270 BTC stolen from Binance (worth approximately $1.4 billion) can be laundered, it will be very slow, may require substantial discounts, and carries a higher risk of being intercepted along the way—making it unlikely to become selling pressure in the short term.Additionally, Binance co-founder Yi He replied under the tweet, saying, "We will chase this to the end."
According to TechFlow, 37 crypto theft cases linked to Lazarus and North Korean-affiliated hackers occurred between 2017 and 2026, with a reported aggregate valuation of approximately $11.817 billion, and the latest Binance incident alone accounting for roughly $6.3 billion in total impact.
Odaily reports: According to on-chain analyst Aunt Ai's monitoring, the Kanye-associated address (0xdea6...1d5c) began selling 1,390 ETH in batches six hours ago (after news of the Binance hack was disclosed), at an average price of $2,275.6, with a sale value of $3.163 million and a loss of $317,000; it is currently still staking 19,506.17 ETH and has borrowed $27.67 million in stablecoins, with a health score of 1.31. A drop in ETH to $1,689.59 will trigger liquidation.
Musk shared reports on the Binance hacking incident and commented, “Everyday is Zeroday.” Zero-day (zero-day vulnerability) is a technical term in cybersecurity, referring to security flaws in software, systems, or hardware for which developers or vendors do not yet have an available patch, allowing attackers to exploit them. It is called zero-day because when a vendor discovers or learns of the vulnerability, they have zero days to implement a fix in advance.
Odaily reports: According to on-chain analyst The Data Nerd, the Binance hacker has sold altcoins worth approximately $158.25 million and converted all proceeds into 70,480 ETH.The specific sell-offs include: 7.02 million UNI (approximately $39.63 million), 217.5 million ENA (approximately $33.93 million), 7.77 trillion PEPE (approximately $31.66 million), 2.57 million LINK (approximately $26.05 million), 127,953 AAVE (approximately $14.27 million), 21.85 million ONDO (approximately $6.62 million), and 17.32 million WLD (approximately $6.09 million).Currently, all of the aforementioned altcoins held by the relevant address have been fully liquidated.
Odaily reports: Binance founder CZ posted on X that user funds are safe (SAFU), and specifically mentioned that He Yi, despite being pregnant, stayed up all night with hundreds of Binance employees to handle this security incident.CZ stated that many industry friends and even competitors, including peers with whom relations had previously not been friendly, offered much-needed help. He admitted that this incident is deeply painful, but emphasized that Binance will get through it.
According to The Sandbox monitoring, it is aware of the attack incident affecting Binance and is working closely with the Binance team. SAND in user self-custody wallets is unaffected; for SAND held on Binance, please follow Binance's official updates.
On-chain detective ZachXBT stated on the X platform when responding to questions about the identity of the attackers in the Binance security incident that the attackers may be the North Korean hacker group Lazarus Group.
On-chain detective ZachXBT, in response to a question on X regarding the identity of the attacker behind the Binance security incident, stated that the attacker may be the North Korean hacking group Lazarus Group.
Binance stated that preliminary investigations show the security incident may have been caused by a compromised computer belonging to a DevOps engineer, through which attackers submitted unauthorized withdrawals via service containers; the incident affected approximately $6.3 billion, with about $3 billion already frozen on-chain, and losses are covered by the SAFU fund and company funds.
Odaily Report: Binance has issued a security incident progress announcement stating that the preliminary investigation indicates the incident may have originated from the compromise of a DevOps engineer's laptop, through which attackers gained access to service containers and submitted unauthorized withdrawal transactions. No evidence of wallet private key leakage has been found so far, and a complete technical investigation report will be published after the investigation concludes.Binance stated that the incident is expected to cause losses of approximately $6.3 billion. The platform has already collaborated with blockchain partners to freeze approximately $3 billion in affected assets on-chain. The platform will cover all losses through the SAFU fund and the company's own capital, and will update its Proof of Reserves (PoR) after security remediation is completed.As an emergency response measure, Binance has temporarily suspended deposits and withdrawals, revoked authorizations for affected addresses, and is working with law enforcement agencies and blockchain intelligence partners to track and recover the stolen funds. Binance emphasized that user funds are safe, and the related investigation and recovery efforts are still ongoing.
Odaily reports: Jiang Zhuoer, founder of Litecoin Pool, posted on X platform that Binance's potential loss accounts for a limited proportion of user assets and is not expected to trigger a large-scale wave of withdrawals.He compared this situation with the Bybit theft incident in February 2025: Bybit was hacked for approximately $1.46 billion at the time, accounting for 9.01% of its approximately $16.2 billion in user assets; if Binance's gross outflow this time is $5.64 billion, of which $3 billion has been frozen, the net amount after deduction would be approximately $2.64 billion, accounting for 1.6% of its approximately $165.12 billion in user assets.In addition, the gross outflow may also include internal fund transfers by the platform and normal user withdrawals, and cannot all be regarded as stolen funds. Binance is capable of bearing the relevant losses.
Odaily reports: Crypto KOL Seven research posted that "right now, the vast majority of market makers and quantitative firms in the crypto market keep the bulk of their capital and main margin accounts on Binance. Many institutions engage in cross-exchange arbitrage or hedging, and Binance's suspension of withdrawals could cause their funding chains to seize up on the spot—if market volatility continues to intensify, they would be unable to withdraw funds from Binance to top up margin elsewhere. To avoid liquidation, they would be forced to close positions on other exchanges and on-chain, forcibly pulling cash back. This is also why, even though the assets stolen were Ethereum-ecosystem assets, Solana and a bunch of altcoins ended up crashing along with it today."
Binance.US CEO Steve Gregory stated that Binance.US user funds are entirely separate and unaffected by this incident. He also emphasized that Binance.US and Binance are completely independent entities, with no shared asset custody arrangements between them.
Odaily reports: According to Onchain Lens monitoring, the Binance hacker has begun selling STRK; two Hyperliquid traders hold STRK short positions with a combined unrealized profit of $4.46 million, of which one trader has an unrealized profit of $1.61 million and the other trader has an unrealized profit of $2.85 million.