News linked to both this project and an event.
According to official sources, in response to recent security incidents involving Bybit, Bitget, and Binance, OKX founder and CEO Star stated that security should not be an area of commercial competition, but rather a shared responsibility of the entire crypto industry. Over the past decade, major exchanges have made significant progress in private key protection, but potential risks remain in access control and wallet management systems. He emphasized that no system is absolutely secure, and any major security breach at any exchange could undermine trust in the entire industry.Star called on major exchanges in the crypto industry to strengthen cooperation and jointly establish stricter industry security standards and coordinated response mechanisms, including adding verification and security delays for large withdrawals to unknown addresses and smart contract authorization transactions, and implementing key security restrictions at the cryptographic signing layer. Meanwhile, the industry should establish real-time security incident reporting, joint monitoring of suspicious funds, and rapid response mechanisms, and promote collaborative research in areas such as quantum-resistant cryptography and AI-driven security threat defense. He emphasized that no single company can safeguard the future of the crypto industry alone.
OKX founder Star stated that following a series of security incidents at Bybit, Bitget, and Binance, he called on industry CEOs to join forces and establish stronger security standards and coordinated response mechanisms, including mandatory security restrictions at the signature layer, real-time incident reporting, and rapid freezing of stolen assets.
that, according to Onchain Lens monitoring, the hacker group allegedly linked to the $5.8 billion Binance attack is transferring over $1 billion worth of ETH to new wallets and may be preparing to launder the funds through Tornado and other mixers.
SlowMist Chief Information Security Officer 23pds stated that, based on historical forensic experience, the one-time transfer of Binance's assets indicates the attacker successfully bypassed the risk control system. Whether the intrusion vector involved a leaked private key or compromised signing machines still requires priority verification. He personally leans toward the private key leakage hypothesis and believes the attacker most likely employed custom-built withdrawal tools. He advises security teams to prioritize investigating private key leak pathways and anomalies associated with unauthorized withdrawal tools during attribution and forensic investigations.
Odaily News: According to Lookonchain monitoring, after the Binance attacker completed the sell-off of all 217.5 million ENA (worth approximately $33.93 million), a newly created wallet address (0xedc0) began going long on ENA.The address deposited 2 million USDC into Hyperliquid, then opened a long position of 22.78 million ENA with 3x leverage, with the position value at approximately $4.09 million.
Odaily reports: An empirical study presented at USENIX Security 2026 shows that among the approximately 3.66 million early EIP-7702 authorization transactions across seven chains, about 63% were associated with malicious contracts; confirmed losses exceed $2.3 million, and 924 malicious contracts were identified. Most attacks use phishing to trick users into signing authorizations that delegate their wallets to sweeper contracts. On-chain analysis shows that in today's anomalous outflow event from Binance hot wallets, attackers exploited EIP-7702 authorizations signed by hot wallets including Binance 14 to delegate accounts to pre-deployed malicious sweeper contracts, then transferred assets in bulk within minutes. Estimates from multiple parties put the scale in the billions of dollars, and Tether, Circle, and others have frozen some stablecoins. This incident aligns with the risks identified in the research: whether through private key leakage or abuse of signing systems, once attackers obtain a legitimate authorization signature, EIP-7702 grants them persistent execution control over the account until the authorization is revoked.
Odaily reports: According to Lookonchain monitoring, after the Binance attack incident, a whale address 0x8add immediately shorted 22,047 ETH (approximately $48.89 million) and 620.7 BTC (approximately $47.89 million) at maximum leverage, with the two short positions totaling approximately $96.78 million in notional value. Currently, the trader's unrealized profit on these positions has reached $2.29 million.
Odaily Report: Derek Chiang, founder of ZeroDev and a developer involved with EIP-7702, posted on X stating that first, to be clear — EIP-7702 itself has no vulnerability. If you are using a wallet that supports EIP-7702 (MetaMask, Uniswap, Ambire, etc.), please do not panic.EIP-7702 is an Account Abstraction improvement proposal that allows externally owned accounts (EOAs) to sign a special message called a "7702 authorization," thereby embedding a smart contract into that account. This enables accounts to achieve powerful functionality, such as transaction batching — combining "authorization" and "transfer" into a single transaction, allowing you to complete a swap on Uniswap with just one click.Unfortunately, the same feature also allows hackers to efficiently transfer all your tokens in a single transaction. In the Binance hack incident, the hacker moved ETH, USDT, and 62 other tokens in one transaction, whereas without EIP-7702, they would have needed to send a separate transaction for each token. In this particular incident, many such transactions would have failed anyway, because Binance was still using the compromised wallet for withdrawals at the time, so all transactions sent by the hacker had to compete with legitimate transactions for Nonce (transaction sequence number). Therefore, using EIP-7702 did help the hacker steal funds as quickly and as extensively as possible.However, for the hacker to use EIP-7702, one of the following conditions must have been met: first, they obtained the private key; second, they tricked Binance into signing a 7702 authorization — the latter is highly unlikely, as it is hard to imagine Binance exposing an endpoint used for signing 7702 authorizations (or worse, signing raw messages that could be repackaged by the hacker for 7702 authorization). But until the official postmortem report is released, this possibility cannot be completely ruled out.Derek Chiang added: "As one of the contributors to account abstraction, I feel somewhat responsible for this hack incident, because while giving accounts more powerful functionality, we have indeed also given hackers stronger capabilities."
Odaily reports: According to monitoring by on-chain analyst Ai Yi, the UXLINK hacker-linked address (0xde8...9524) opened a 30,282.4 ETH long position on Hyperliquid. Its unrealized profit reached $7.422 million in the early hours of today, but has now narrowed to $2.45 million. The original post stated that ETH came under pressure and pulled back due to the recent Binance hack incident.
Odaily Report: LlamaRisk posted on the governance forum stating that after the attack on Binance's Ethereum hot wallet, LlamaRisk, Aave Labs, and others decided to have the guardian freeze markets across the network, freezing a total of 175 reserve types across 16 networks covered by Aave V3, as well as 117 reserves across four spoke categories in Aave V4. Aave will continue to monitor the attacker's wallets and price feeds, and once fund flows cease, it will coordinate with all parties to unfreeze in phases.
Odaily reports: According to Lookonchain monitoring, the Binance attacker has completed the sell-off of 7 tokens including UNI, ENA, PEPE, LINK, AAVE, ONDO, and WLD, cumulatively converting to 70,480 ETH, valued at approximately $158.25 million based on current quoted prices. Among them:UNI: sold 7.02 million tokens, worth $39.63 million, at an average price of $5.65;ENA: sold 217.5 million tokens, worth $33.93 million, at an average price of $0.16;PEPE: sold 7.77 trillion tokens, worth $31.66 million, at an average price of $0.0000041;LINK: sold 2.57 million tokens, worth $26.05 million, at an average price of $10.14;AAVE: sold 127,953 tokens, worth $14.27 million, at an average price of $111.55;ONDO: sold 21.85 million tokens, worth $6.62 million, at an average price of $0.30;WLD: sold 17.32 million tokens, worth $6.09 million, at an average price of $0.35.
Odaily Report: During the Binance attack, an obvious arbitrage opportunity emerged on-chain. According to a community user's review, the attacker, in order to avoid Tether freezing, swapped a large amount of USDT for ETH through DEXs, causing the ETH price on Uniswap to briefly rise to $2,560–$2,750, with some individual trades exceeding $3,000, while Aave's ETH price obtained through the Chainlink oracle remained at $2,250–$2,290. A price gap of 15% to 30% appeared between on-chain and oracle prices, lasting nearly an hour.Arbitrageurs exploited this price gap by depositing USDC/USDT as collateral into Aave, borrowing ETH at the oracle price, then selling it at high prices on DEXs, and buying back ETH to repay the loans once the spread narrowed. According to the user's statistics, within 6 hours after the incident, a total of 61 addresses borrowed ETH on Aave mainnet (excluding the hacker's address). Among them, the most profitable address sold 12,289 ETH at an average price of approximately $2,580, then bought back 12,314 ETH at an average price of approximately $2,297, earning about $3.47 million. The top ten arbitrage addresses collectively profited approximately $6.36 million.The user stated that the arbitrageurs exploited the price disconnection between centralized exchanges and DEXs, and that the Aave contract itself had no vulnerability. As DEX prices fell back and Aave froze the mainnet V3 market, the arbitrage window gradually closed. The above profits are based on transaction-by-transaction on-chain statistics and have not yet deducted Gas fees.
Arkham has flagged the hacker behind the Binance attack, and its team has now verified 70 on-chain addresses associated with the hacker.
Odaily Report: According to monitoring by Benson Sun, Coinkarma founder Benson Sun posted that in Binance's recent theft incident, the exchange has confirmed the freezing of approximately $2.5 billion in assets, accounting for about half of the total stolen amount, with the remaining assets primarily consisting of Bitcoin and ETH. The stolen Bitcoin is worth approximately over $1 billion, but Bitcoin lacks deep mixing pools similar to Tornado Cash, and the relevant addresses will be flagged by trading platforms and on-chain analytics firms, making it far more difficult to liquidate than ETH. Reviewing cases such as the 2016 Bitfinex stolen Bitcoin that remained untouched for years, and the approximately 1,800 BTC stolen from Coldcard in July this year with 90% still unmoved as of early September, Benson Sun stated that this theft is larger in scale, and splitting addresses, mixing coins, and then discounting through OTC trading could take years, with short-term selling pressure nearly zero. If Binance uses SAFU to compensate and replenish Bitcoin, it could instead create buying pressure. In contrast, large amounts of ERC-20 tokens converted into ETH and then deposited into Tornado Cash are harder to trace, and the amount that could genuinely translate into market selling pressure may be in the range of over $1 billion. Benson Sun believes that market confidence will be impacted, but the direct selling pressure on Bitcoin is not as large as imagined, and called on the industry to seriously address security arrangements for hot wallet management, signature authorization, and quantum resistance in the post-AI era.
Binance has posted an update on the handling of the theft incident, stating that the total amount of assets confirmed frozen is approximately $3 billion. The Binance team continues to work closely with law enforcement agencies, asset issuers, blockchain intelligence firms, and industry partners to trace and freeze more assets.Binance stated that it will only publish verified data going forward, and will further update progress as more information is confirmed, while emphasizing the safety of user funds.
Odaily — According to on-chain analyst Aunt Ai, 30 minutes ago, the Binance hot wallet hacker transferred all 74.56 million ARB to address 0x000...0DA0. Arkham has tagged this address as Kelp DAO Hacker, and these tokens have not yet been moved or sold. Kelp DAO suffered an attack on April 18 this year, losing approximately $292 million in rsETH, and at the time the community speculated that the attacker was the North Korean hacker group Lazarus Group.
Arbitrum officially announced that the Arbitrum Security Council has taken emergency action to transfer 74,559,805 ARB tokens and 8,425 ETH held by addresses associated with the Binance attack incident on Arbitrum One. Following technical assessment and review, the Security Council transferred the funds to an intermediate frozen wallet via a specific technical solution, without impacting other network states, users, or applications on Arbitrum.
Odaily Report: According to monitoring by SlowMist's Cosine, the Binance hacker chose the EIP-7702 mechanism on Ethereum solely for convenience of sweeping — that is, to mass-drain tokens from Binance-related hot wallets. On-chain records show that the hacker's operations were rather crude, and they conducted several hours of rehearsal and preparation before the actual theft. The EIP-7702 mechanism itself is not the problem; even without this protocol mechanism, other methods exist.
On-chain data shows that Binance 14, one of Binance's stolen hot wallets, revoked its EIP-7702 authorization at 8:10 AM Beijing Time today.
Bonk Guy posted on X stating that the Binance incident is unlikely to trigger systemic risk. Binance is reportedly generating annual revenue of approximately $16-17 billion, and nearly half of the funds involved in this incident have already been frozen or may be recovered. The amount that may ultimately be unrecoverable is approximately $3.2 billion, equivalent to about 2 to 2.5 months of Binance's revenue, which remains manageable relative to its operating scale.Bonk Guy noted that both Changpeng Zhao (CZ) and He Yi have publicly stated that user funds are safe and that all losses will be fully covered. He believes the likelihood of systemic risk and a bank run is extremely low, and that the market should be more vigilant about panic selling and media overhyping, reminding investors not to make trading decisions based on panic sentiment.