News linked to both this project and an event.
Pons founder Ozzy posted on X platform that, according to a Blockaid warning, the StepDrainer attack previously targeting projects such as Kintsu and Flap is expanding and now involves StonkFun, Pickle Finance, Echelon, Origami, Fluxbeam, Stakepoint, SupSwap, Longbow, SHPRD, and ApeX DeFi. Blockaid reminds users to temporarily avoid visiting the above websites and the previously disclosed affected DApps, and not to connect their wallets.
World Liberty advisor Ogle posted on X platform stating that they received an alert from security firm Blockaid, warning users to temporarily avoid visiting the relevant websites or connecting wallets. According to the publicly disclosed alert information, Blockaid stated it has detected an active front-end attack related to the StepDrainer toolkit, involving Kintsu, Flap, and StonkBrokers. The affected sites have been injected with malicious scripts, and users who click "Connect Wallet" may be redirected to malicious asset-draining pages. Blockaid is currently investigating and gathering more information, with further updates to be announced.
Blockaid CEO Ido Ben-Natan stated that the preliminary assessment indicates Binance was either hacked or had its private keys "abused" due to a compromised signing infrastructure, rather than a private key leak, and noted that it is highly similar to the Bybit theft incident.
Blockaid stated that the attacker batch-submitted 50 EIP-7702 authorizations in a single transaction to hit Binance's hot wallet real-time nonce; only one succeeded, after which the wallet was subsequently upgraded to a receiving contract. The associated address also transferred out approximately $37.48 million worth of PEPE.
According to CoinDesk and security firm Blockaid, Binance's hot wallet has experienced large-scale abnormal outflows since 04:24 Beijing Time. New addresses are holding over $2 billion in assets, Binance has not yet confirmed an attack; BNB dropped approximately 6% within one hour.
Blockaid has published two attacker addresses, example attack transactions, victim contracts, and cross-chain bridge addresses. One of the attacker addresses (0xaCA0...5718) currently holds a balance of approximately $11,000 USD.
Blockaid reported detecting an attack on the Tranche Vault associated with Valinor Digital on Avalanche. The attacker leveraged flash loans to mint artificially inflated tranche shares, then proceeded to redeem the vault’s remaining USDC. As of this post, the attacker had transferred approximately $1.01 million from the vault across roughly two transactions.
As of now, three attack transactions have enabled the attacker to acquire approximately 4.85 million USDT and around 550,000 X, with roughly 12.2 million X still remaining in the Freezer. Blockaid states that the attack is ongoing.
according to Blockaid monitoring, the WAX multichain bridge on the WAX network is under attack, involving WAX, Solana, and Ethereum. The attacker withdrew mapped tokens on the WAX chain without paying the corresponding assets, while the bridge contracts on Solana and Ethereum still released the corresponding tokens. The attacker transferred approximately 52,986 USDC, 21,558 USDT, 840 DAI, 2.55 WETH, and 0.11 WBTC through 5 transactions. The scope of the incident's impact and whether losses are still expanding remain to be further confirmed.
According to The Defiant, data from Blockaid shows that between January and August 2026, the 60 cryptocurrency attack incidents it tracked involved approximately $1.18 billion, with victims recovering a total of about $9.8 million, accounting for less than 1%. The report indicates that all frozen or returned funds were secured through on-chain governance or validator actions, while blacklist mechanisms by stablecoin issuers recovered zero funds across these 60 incidents.
According to Blockaid monitoring, a vault on the Base chain is currently under attack. The attacker added a brand-new contract to the vault's whitelist, then borrowed aBaswstETH and transferred it to the attacker's contract. The attack is still ongoing, and approximately 4 transactions have resulted in about $2.02 million in assets being stolen.
Blockaid warns that users who previously authorized Payment Processor V2 as an NFT Operator should immediately revoke the relevant authorization. Simply canceling listings or Master Nonce cannot remove this permission.
According to Blockaid, Meter is facing ongoing attacks on BNB Chain. Attackers are exploiting Meter Passport to mint a large amount of wrapped MTRG and sell portions on PancakeSwap. Approximately $2.3 million in unbacked wrapped MTRG has been minted through around two issuance transactions so far, and the attack remains ongoing.
According to Blockaid monitoring, Meter is currently under a sustained attack on BNB Chain. The attacker exploited Meter Passport to mint a large amount of wrapped MTRG and sold some of the tokens on PancakeSwap. So far, approximately $2.3 million in unbacked wrapped MTRG has been minted through about 2 minting transactions, and the attack is still ongoing.
According to Blockaid monitoring, Flamingo Finance's legacy Flamincome contract was attacked. The attacker borrowed approximately 18 million USDT via a flash loan, staked USDP LP into the Strategy contract to inflate the VaultYUSDT share price, and subsequently redeemed aUSDT liquidity, currently realizing profits of approximately $345,900.
According to CoinDesk, a Gnosis Safe wallet on Ethereum was attacked, with approximately 2,900 rsETH (valued at around $7.8 million) transferred. Security firms BlockSec, Blockaid, and SlowMist pointed out that the root cause of the attack lies in an authorization check flaw within the wallet-approved Multicall contract—the contract is intended to verify caller permissions, but the vulnerability allows anyone to bypass validation simply by targeting the contract itself. The attacker subsequently moved the rsETH into a liquidity pool based on the valueless token "Permissionless Attacker Token." An automated bot named "yoink" paid approximately $47,000 to frontrun the transaction, transferring 2,882 rsETH to a separate address. rsETH issuer Kelp DAO stated that its smart contracts are secure and rsETH is fully collateralized, and has implemented a 24-hour pause measure on the relevant addresses.
Blockaid stated that its vulnerability detection system identified that a Safe wallet belonging to an unidentified user on Ethereum was compromised, resulting in confirmed losses of approximately $7.73 million in rsETH. The attacker leveraged a public keeper's multi-call to route the custom Uni V4 LP Safe module to a hook-enabled liquidity pool they created, causing the associated hook to unwrap aEthrsETH into rsETH. The exploit was extracted via MEV within the block.
Odaily News: On-chain security platform Blockaid has discovered a vulnerability in the Bitcoin bridge of cross-chain protocol Symbiosis. The attacker minted approximately 2^62 syBTC to a newly created externally owned account, with a face value of roughly $46.1 billion calculated at 8 decimal places, and sold approximately 4.39 WBTC on Uniswap V4 on Ethereum, realizing a cash-out of about $336,000.Symbiosis stated that the attack occurred at around 4:28 AM on September 11. The team has paused the BTC route, while other routes remain operational and unaffected. The team has recovered approximately 15 BTC and deposited them into a multisig wallet controlled by the team. They have also offered the attacker a 20% white-hat bounty, with a deadline of September 13.In recent weeks, Liquid Network, Nomic, and Symbiosis have all experienced security incidents involving the inflation of supply through the minting of tokens without real asset backing. As of September 13, Symbiosis has not yet publicly released a BridgeV2 technical post-mortem, the final loss amount, or confirmation of whether the attacker has accepted the bounty. (Bitcoin.com News)
Odaily News DeFi risk management protocol Cozy Finance is currently facing an ongoing attack on its Optimism deployment, with attackers having stolen approximately $170,000 in assets so far. Blockaid has subsequently released preliminary attack information and flagged the attacking transactions along with related attacker addresses. Multiple attacker addresses have now been confirmed, along with a token address suspected to have been exploited in the attack. It remains unclear whether the attack is still ongoing, and users should exercise caution when interacting with contracts associated with Cozy Finance.
Odaily News: According to blockchain security firm Blockaid's monitoring, More Markets (More Labs) on Flow EVM has been exploited. The attacker leveraged Ankr's liquid staking tokens and the E-Mode mechanism to drain More Markets' WFLOW lending reserves, transferring approximately 15.5 million WFLOW from the mFlowWFLOW reserve. The detected impact amount is approximately $9.3 million, and the related attack transaction cluster also includes post-exploit fund transfer operations. At present, the specific losses and the destination of the attacker's funds are still under further confirmation.