News linked to both this project and an event.
According to an official post by PancakeSwap, the platform voiced support for the Binance team and all parties involved in addressing the security incident, emphasizing that it remains unaffected, its contracts and services are operating normally, and the team is closely monitoring the situation. As a major decentralized exchange in the BNB Chain ecosystem, PancakeSwap's statement aims to stabilize user expectations.
BNB Chain has issued a statement expressing support for Binance and the teams that have been handling the security incident since last night, and confirming that BNB Smart Chain, opBNB, BNB Greenfield, and the BNB Chain cross-chain bridge were all unaffected by this incident. All networks are currently operating normally, and funds on BNB Chain are safe. BNB Chain also stated that it fully trusts the Binance team to handle this incident and will continue to collaborate with ecosystem partners to strengthen security protections and maintain industry trust.
Odaily Report: During the Binance attack, an obvious arbitrage opportunity emerged on-chain. According to a community user's review, the attacker, in order to avoid Tether freezing, swapped a large amount of USDT for ETH through DEXs, causing the ETH price on Uniswap to briefly rise to $2,560–$2,750, with some individual trades exceeding $3,000, while Aave's ETH price obtained through the Chainlink oracle remained at $2,250–$2,290. A price gap of 15% to 30% appeared between on-chain and oracle prices, lasting nearly an hour.Arbitrageurs exploited this price gap by depositing USDC/USDT as collateral into Aave, borrowing ETH at the oracle price, then selling it at high prices on DEXs, and buying back ETH to repay the loans once the spread narrowed. According to the user's statistics, within 6 hours after the incident, a total of 61 addresses borrowed ETH on Aave mainnet (excluding the hacker's address). Among them, the most profitable address sold 12,289 ETH at an average price of approximately $2,580, then bought back 12,314 ETH at an average price of approximately $2,297, earning about $3.47 million. The top ten arbitrage addresses collectively profited approximately $6.36 million.The user stated that the arbitrageurs exploited the price disconnection between centralized exchanges and DEXs, and that the Aave contract itself had no vulnerability. As DEX prices fell back and Aave froze the mainnet V3 market, the arbitrage window gradually closed. The above profits are based on transaction-by-transaction on-chain statistics and have not yet deducted Gas fees.
According to an official announcement from Cysic, following the cross-chain bridge security incident that occurred earlier, Cysic has fully resumed its cross-chain bridge services, and users can now once again transfer CYS across chains between the Cysic mainnet and other supported blockchains. Additionally, Cysic has permanently burned 7,200,002 CYS on the BNB Smart Chain and confirmed that this operation has been recorded on-chain.
According to an official announcement from BNB Chain, the winner list for the BNB Hack: Tokenized Edition hackathon has been announced. Co-hosted by BNB Chain and Binance Wallet, the event awarded five projects from a total prize pool of $20,000. Moi took first place, while 4lpha, Redeye, TARE, and Firstshare ranked second through fifth. Additionally, 4lpha won the Best Agentic Wallet / Wallet Skills Application award, and Firstshare won the Best BNB Agent Studio Application award.
Blockaid has published two attacker addresses, example attack transactions, victim contracts, and cross-chain bridge addresses. One of the attacker addresses (0xaCA0...5718) currently holds a balance of approximately $11,000 USD.
Cysic has released an update on the progress of handling the security incident, disclosing that it has completed burning 7,200,002 CYS tokens on the BNB Smart Chain (BSC) to offset prior unauthorized token issuance. Both burn transactions have been confirmed on-chain, permanently reducing the CYS token supply on BSC and bringing it back into alignment with the project's tokenomics.
According to Scam Sniffer monitoring, a suspected cryptocurrency theft incident has occurred: in under 4 hours, an attacker drained USDT, USDC, and ETH with a total value of approximately $1.2 million from over 100 wallets across Ethereum and BNB Chain, and has already converted all funds into ETH.
According to PRNewswire, S&P Global (NYSE: SPGI) announced on October 26 that it has completed its acquisition of OpenZeppelin, a provider of on-chain financial security standards. The transaction was first announced on September 17, with financial terms undisclosed, and is not expected to have a material impact on S&P Global’s financial results. Founded in 2015, OpenZeppelin has completed over 900 security service engagements and identified more than 10,000 vulnerabilities before product launches. Its open-source smart contract library, OpenZeppelin Contracts, supports value transfers exceeding $38 trillion, encompassing various mainstream stablecoins and tokenized funds. This acquisition will expand S&P Global’s risk assessment capabilities into the on-chain technology risk layer, and both parties plan to jointly develop a new generation of on-chain security assessments and benchmarks. After the acquisition, OpenZeppelin will continue to operate as an independent business unit under its original brand, with founder Demian Brener staying on as head, reporting to Yann Le Pallec, President of S&P Global Ratings. OpenZeppelin Contracts will remain open-source, free, and publicly maintained.
According to on-chain anti-money laundering monitoring platform AMLBot, Tether has frozen approximately $2.2 million worth of USDT related to the hacking incident at cryptocurrency exchange CoinDCX, involving multiple on-chain addresses.
On-chain analyst PeckShield (@PeckShieldAlert) has tracked an address flagged as the Cysic attacker depositing 300 ETH (approximately $721,140) and 30.4 BNB (approximately $22,590) into Tornado Cash. According to the Cysic Foundation, a security incident involving the Cysic cross-chain bridge occurred on October 17, during which the attacker minted 10 million CYS tokens without authorization on the BNB Chain.
In an announcement posted on October 22 via Pirate Chain’s official X account (@PirateChain), the team released mandatory update v6.0.14. On October 14, attackers exploited two verification vulnerabilities to mint approximately 39.82 million fake ARRR in the transparent coinbase pool, temporarily inflating the supply by about 20%. Following a consensus reached by the community, node operators, mining pools, exchanges, and dPoW notarizers, the chain was rolled back to block height 4,176,944 (October 14 at 19:55:14 UTC, prior to the attack). Version 6.0.14 automatically rejects the exploited blocks and all subsequent blocks, completely removing the counterfeit coins, while the maximum supply of ARRR remains unchanged at 200 million. dPoW notarizers have agreed to continue notarizing the patched chain, and old forks will no longer receive notarization. The team requires all users, Treasure Chest and CLI node operators, miners, mining pools, exchanges, and service providers to immediately deactivate the outdated version and upgrade.
SlowMist monitoring reveals that LiteLLM has once again been targeted by a supply chain attack. The malicious version [email protected] affects PyPI packages and Docker images, including floating tags such as latest and main-stable. This malware executes automatically upon Python startup, stealing sensitive data such as cloud service credentials, AI API keys, and SSH private keys, and enables remote code execution. The affected versions have currently been removed or replaced. SlowMist advises users to avoid using version 1.107.0, rebuild affected environments with clean images, rotate potentially exposed credentials, and pin the version to 1.106.2.
Dragonfly Managing Partner Haseeb Qureshi (@hosseeb) posted on X stating that the cybersecurity sector is experiencing a pandemic-like wave of attacks. He views on-chain breaches as a "warning signal" for the broader internet security landscape, as it remains the easiest place for cyberattacks to be monetized. He noted that while the volume of exploits in the crypto space has surged significantly, the annualized value of stolen assets remains roughly consistent with 2025 levels—indicating a trend of increased attack frequency offset by smaller individual amounts. Smaller, under-maintained protocols are facing mass breaches, while major protocols have already integrated AI tools to bolster their defenses. He anticipates that a similar dynamic will soon emerge in the traditional cybersecurity industry.
Nina Rong (@nina_rong), Head of Growth at BNB Chain, posted that BNB Chain's technology stack does not use PHP and reminded users to remain vigilant. Previously, the National Security Agency's cybersecurity division NSA Cyber (@NSACyber) issued an advisory stating that all organizations using PHP to build systems should prepare for updates aimed at fixing two critical vulnerabilities. PHP is widely used in web applications, and such vulnerabilities can typically provide direct access to the server file system.
Cysic has issued a service status update stating that the Cosmos explorer is temporarily unavailable, Cysic mainnet operations are unaffected, and explorer access is being restored as quickly as possible. Following the recent security incident, the cross-chain bridge remains paused. Funds related to pending cross-chain transactions remain safely held in the cross-chain bridge contract, and the relevant transactions will be processed once the cross-chain bridge is secure again.
The Cysic Foundation released an incident report stating that on October 17, its cross-chain bridge experienced a security incident in which an attacker minted 10 million CYS without authorization on the BNB Smart Chain. Upon discovering the anomaly, the project team suspended the cross-chain bridge, placed related addresses on an on-chain blacklist, and hired a professional security firm to investigate the attack vectors and fund flows.
Odaily reports: The crypto project Cysic has announced that its cross-chain bridge was paused on Saturday after an attacker exploited a processing flaw to mint 10 million CYS tokens without authorization on BNB Smart Chain. Preliminary investigations indicate that the attacker may have gained unauthorized access to the database supporting the bridge.The unauthorized minting occurred at 12:31:38 UTC, and Cysic blacklisted the receiving address in the token contract at 13:47:52. The address currently still holds approximately 2.8 million CYS, and related transfers have been restricted.Cysic stated that the incident only involved cross-chain bridge message processing and token minting, and did not affect the mainnet or other operating systems, nor did it result in the theft or unauthorized transfer of existing CYS or other assets in user wallets. Token transfers, swaps, and actual losses are still under review, and the company has engaged security firms and plans to release a follow-up report. (Cointelegraph)
Odaily reports: Bitcoin News posted on X platform that former Mt. Gox CEO Mark Karpelès accused Ledger of failing to adequately alert customers to sophisticated hardware implants after learning of the relevant threat as early as March 2026, and of burying related warnings in Ledger Academy articles. Karpelès stated that evidence of mass-produced, self-aligning implants should have triggered a highest-level alarm response. After Ledger CEO Pascal Gauthier responded by referencing his Mt. Gox experience, Karpelès fired back, saying he had trusted Ledger to learn from his failures and do better than he did. Karpelès also criticized Ledger for continuing to downplay the incident and questioned its communication with affected customers.
Odaily reports: SlowMist has issued a warning that a fake "Ledger firmware update" campaign is exploiting the recent Ledger supply chain incident to conduct attacks. The phishing page is highly convincing, including a fake "Genuine check" page, a device selection interface, and an "Update Now" button. SlowMist reminds users never to update Ledger devices through website links and never to enter their Recovery Phrase anywhere.