News linked to both this project and an event.
Odaily Report: LlamaRisk posted on the governance forum stating that after the attack on Binance's Ethereum hot wallet, LlamaRisk, Aave Labs, and others decided to have the guardian freeze markets across the network, freezing a total of 175 reserve types across 16 networks covered by Aave V3, as well as 117 reserves across four spoke categories in Aave V4. Aave will continue to monitor the attacker's wallets and price feeds, and once fund flows cease, it will coordinate with all parties to unfreeze in phases.
Odaily reports: According to Lookonchain monitoring, the Binance attacker has completed the sell-off of 7 tokens including UNI, ENA, PEPE, LINK, AAVE, ONDO, and WLD, cumulatively converting to 70,480 ETH, valued at approximately $158.25 million based on current quoted prices. Among them:UNI: sold 7.02 million tokens, worth $39.63 million, at an average price of $5.65;ENA: sold 217.5 million tokens, worth $33.93 million, at an average price of $0.16;PEPE: sold 7.77 trillion tokens, worth $31.66 million, at an average price of $0.0000041;LINK: sold 2.57 million tokens, worth $26.05 million, at an average price of $10.14;AAVE: sold 127,953 tokens, worth $14.27 million, at an average price of $111.55;ONDO: sold 21.85 million tokens, worth $6.62 million, at an average price of $0.30;WLD: sold 17.32 million tokens, worth $6.09 million, at an average price of $0.35.
Odaily Report: During the Binance attack, an obvious arbitrage opportunity emerged on-chain. According to a community user's review, the attacker, in order to avoid Tether freezing, swapped a large amount of USDT for ETH through DEXs, causing the ETH price on Uniswap to briefly rise to $2,560–$2,750, with some individual trades exceeding $3,000, while Aave's ETH price obtained through the Chainlink oracle remained at $2,250–$2,290. A price gap of 15% to 30% appeared between on-chain and oracle prices, lasting nearly an hour.Arbitrageurs exploited this price gap by depositing USDC/USDT as collateral into Aave, borrowing ETH at the oracle price, then selling it at high prices on DEXs, and buying back ETH to repay the loans once the spread narrowed. According to the user's statistics, within 6 hours after the incident, a total of 61 addresses borrowed ETH on Aave mainnet (excluding the hacker's address). Among them, the most profitable address sold 12,289 ETH at an average price of approximately $2,580, then bought back 12,314 ETH at an average price of approximately $2,297, earning about $3.47 million. The top ten arbitrage addresses collectively profited approximately $6.36 million.The user stated that the arbitrageurs exploited the price disconnection between centralized exchanges and DEXs, and that the Aave contract itself had no vulnerability. As DEX prices fell back and Aave froze the mainnet V3 market, the arbitrage window gradually closed. The above profits are based on transaction-by-transaction on-chain statistics and have not yet deducted Gas fees.
Odaily Report: According to monitoring by Benson Sun, Coinkarma founder Benson Sun posted that in Binance's recent theft incident, the exchange has confirmed the freezing of approximately $2.5 billion in assets, accounting for about half of the total stolen amount, with the remaining assets primarily consisting of Bitcoin and ETH. The stolen Bitcoin is worth approximately over $1 billion, but Bitcoin lacks deep mixing pools similar to Tornado Cash, and the relevant addresses will be flagged by trading platforms and on-chain analytics firms, making it far more difficult to liquidate than ETH. Reviewing cases such as the 2016 Bitfinex stolen Bitcoin that remained untouched for years, and the approximately 1,800 BTC stolen from Coldcard in July this year with 90% still unmoved as of early September, Benson Sun stated that this theft is larger in scale, and splitting addresses, mixing coins, and then discounting through OTC trading could take years, with short-term selling pressure nearly zero. If Binance uses SAFU to compensate and replenish Bitcoin, it could instead create buying pressure. In contrast, large amounts of ERC-20 tokens converted into ETH and then deposited into Tornado Cash are harder to trace, and the amount that could genuinely translate into market selling pressure may be in the range of over $1 billion. Benson Sun believes that market confidence will be impacted, but the direct selling pressure on Bitcoin is not as large as imagined, and called on the industry to seriously address security arrangements for hot wallet management, signature authorization, and quantum resistance in the post-AI era.
Arbitrum officially announced that the Arbitrum Security Council has taken emergency action to transfer 74,559,805 ARB tokens and 8,425 ETH held by addresses associated with the Binance attack incident on Arbitrum One. Following technical assessment and review, the Security Council transferred the funds to an intermediate frozen wallet via a specific technical solution, without impacting other network states, users, or applications on Arbitrum.
Odaily Report: According to monitoring by SlowMist's Cosine, the Binance hacker chose the EIP-7702 mechanism on Ethereum solely for convenience of sweeping — that is, to mass-drain tokens from Binance-related hot wallets. On-chain records show that the hacker's operations were rather crude, and they conducted several hours of rehearsal and preparation before the actual theft. The EIP-7702 mechanism itself is not the problem; even without this protocol mechanism, other methods exist.
Cobo co-founder Shenyu released a video analyzing the Binance theft from an on-chain transaction perspective. At 4:20 AM, the attacker broadcast a transaction containing 50 authorization requests signed with Binance's hot wallet private key, and began batch-transferring assets approximately three minutes later. Shenyu noted that the attack utilized the EIP-7702 authorization mechanism; the attacker had prepared a transfer list covering 64 tokens in advance and conducted two test runs using a test wallet, with the final run occurring roughly 3.5 hours before the main operation. The attacker subsequently transferred assets through multiple wallets and smart contract wallets, exchanging portions of stablecoins such as USDT for ETH to evade issuer-initiated freezes.
Odaily reports: According to on-chain analyst Aunt Ai, a hacker has sold off all 7.77 trillion PEPE tokens from Binance's hot wallet, exchanging them for 14,049 ETH worth over $31.9 million, at an average selling price of approximately $0.0000041, causing PEPE's price to drop 12.33%. Currently, the unrealized profit on the 11.8 trillion PEPE transferred out by Brother Sun since October 17 has shrunk to $4.45 million, with an average withdrawal price of approximately $0.000004114; last night, his unrealized profit had once reached $18.55 million.
According to CoinDesk's analysis, the hacked Binance Hot Wallet 14 was listed in Binance's October 1 Proof of Reserves; following the theft of approximately 204,500 ETH, its ETH backing ratio may drop from 100% to around 94%, with the next reserve snapshot scheduled for November 1.
Odaily reports: According to monitoring by on-chain analyst Yu Zhan, Binance appears to have suffered a large-scale security incident in the early hours of today, with approximately $3.43 billion in assets stolen. This figure excludes about $2.43 billion in stablecoins that stablecoin issuers helped freeze.Among the stolen assets, the largest single item was 18,270 BTC, worth approximately $1.44 billion, and the relevant BTC has not yet been moved. Meanwhile, the hacker is converting other altcoins into ETH, and the ETH held has now reached approximately 467,000, worth about $1.06 billion.
Odaily reports: Smart contract developer Justin Kalland posted on X that the Binance hacker appears to have made a potential mistake, and MetaMask should retain as much of any Web2 logs as they can obtain.Specifically, the hacker sent 175 million USDT to a new wallet, and about 2.5 minutes later, that wallet also received 2 ETH. This was likely used to pay for Gas fees, consistent with the pattern used by their other attack wallets.Exactly two minutes after that, the wallet used MetaMask's Gas Station service, even though it already had Gas fees at the time. Three consecutive transactions landed in the same block — an ETH top-up from Gas Station, an infinite USDT approval to the Kyber Network router, and a payment of 127.67 USDT to Gas Station. The amount of the ETH top-up exactly matched the combined maximum Gas budget of the Kyber approval and the USDT payment. Accurate down to wei (the smallest Ethereum unit).But the problem is that the ETH they had at the time was already fully sufficient to cover both fees, so a reasonable speculation is that they were using a MetaMask wallet at the time and, due to haste, mistakenly selected USDT to pay for Gas fees. For convenience, MetaMask sometimes defaults to this method, and the order of top-ups within the same block also matches how its implementation mechanism works.To use Gas Station in MetaMask, users must use MetaMask Sentinel. This means the transactions were broadcast through them, rather than through a regular RPC. This interaction likely left off-chain records at MetaMask, which may include IP metadata.Among all the attacker's wallets that have been checked, this is the only wallet showing use of Gas Station, and the wallet address is: 0xAa246BF639586a6Ba46762D378CE50cA4fc654a0.
Odaily Report: Marc Zeller, founder of the Aave Chan Initiative (ACI), posted on X stating that the Aave protocol is fine.The Binance hacker injected 60 million USDT into the protocol within just 3 minutes and borrowed 19,762 wETH (approximately $44.9 million), at which point Tether had not yet frozen the address, nor had the Aave Guardian frozen the Aave V3 Core pool's reserves (this operation occurred 46 minutes later).However, USDT is backed by real dollars, and from the protocol's perspective, although this position is the proceeds of crime, it is overcollateralized — with a health factor of 1.04, holding $59.9 million in collateral against $44.9 million in debt.Of course, the protocol now has a large borrower with little incentive to repay the loan, but the liquidation mechanism will still operate as usual. If the ETH price rises above approximately $2,365 (+4%), the position will be liquidated just like any other position.Currently, the Aave V3 Core pool's total wETH reserves stand at 2.16 million wETH, and the hacker's debt accounts for "only" 0.9% of that, so Aave does not need to take any special action against the hacker. There are currently 345,000 wETH available (capital utilization rate of 81.6%), so if wETH depositors wish to withdraw, liquidity is fully sufficient. There is no reason or need for a bank run to occur.This situation is far less alarming than the Kelp hacker incident (which involved zero-value collateral). In theory, a governance proposal could be passed to force liquidation of the hacker by upgrading the pool (if the USDT liquidation threshold were lowered, it would affect all USDT depositors), but there is no practical benefit to doing so, as the normal liquidation mechanism can easily absorb this debt.
Odaily report: Shenyu posted on X, saying: "Binance 14's 7702 delegation still has not been revoked after 2 hours. A transfer of 2,961 ETH to Binance 14 is still stuck, remaining pending due to a low gas fee. Once it goes on-chain (when the base fee falls below 4.4 gwei), an attacker could sweep away the roughly 2,961 ETH again."
Odaily report: A wallet suspected to be associated with the Binance hack incident received tens of thousands of ETH through a Uniswap contract and borrowed 19,762 ETH on Aave using approximately $60 million in USDT as collateral. On-chain records do not show any vulnerabilities in Uniswap or Aave.As of 22:07 UTC, the two wallets held approximately 253,000 ETH, worth about $570 million, with no outgoing transfers recorded. Aave has paused the Ethereum mainnet V3 market, and Kamino has also paused borrowing in the SOL/BTC market; Ripple has frozen approximately $200 million in RLUSD, and more than $2 billion in USDT and USDC has been frozen by stablecoin issuers. (Decrypt)
According to Decrypt, Binance co-CEO He Yi stated that Ripple has frozen approximately $200 million in RLUSD; suspected hackers are converting freezeable stablecoins into ETH via Uniswap and Aave, while Kamino has suspended SOL/BTC market lending.
According to Lookonchain monitoring, the Binance hacker is currently dumping PEPE, UNI, LINK and other tokens on-chain in exchange for ETH. Lookonchain states that the hacker still holds a large amount of altcoins that may face significant selling pressure, including 217.497 million ENA (worth $39.51 million), 7.579 trillion PEPE (worth $34.41 million), 2.575 million LINK (worth $28.07 million), 128,034 AAVE (worth $15.9 million), 74.56 million ARB (worth $11.54 million), 1.938 million UNI (worth $12.62 million), 21.852 million ONDO (worth $8.52 million), 17.318 million WLD (worth $6.73 million), 714.911 million FUN (worth $6.29 million), 87.853 million ZAMA (worth $6.02 million), 3.602 million ZRO (worth $5.69 million), and 3.382 billion RSR (worth $5.02 million).
According to monitoring by Bitcoin News, a Bitcoin address labeled as a hot wallet in Binance's own transparency disclosures reportedly had approximately 17,500 BTC transferred out. The transfer occurred amid reports of a major security incident involving a Binance-linked Ethereum wallet. It is currently unclear whether this Bitcoin transfer was unauthorized or a movement made for security reasons.
According to Whale Alert, at 05:41 Beijing Time, the address tagged "Binance Hack 2026" transferred 57,891 ETH (approximately $133 million) to a new wallet.
Odaily reports: According to Bitcoin News monitoring, on-chain analysis shows that attackers appear to have exploited the Ethereum EIP-7702 mechanism to obtain signature authorization, installing malicious code without directly accessing the private keys of Binance-associated wallets. The attackers then called a function named "sweep" to transfer ETH and dozens of tokens into wallets under their control; the same delegation permission was reportedly also used to transfer $780 million USDC out of another Binance hot wallet. The attackers' transaction relayer received funding through Tornado Cash, and nearly 195,460 ETH was subsequently transferred to a newly created wallet. How the attackers obtained the relevant authorization remains unclear. Binance stated that user funds are safe and that an investigation is currently underway.
According to on-chain statistics cited by Decrypt, at least $5.57 billion in assets have been transferred from wallets associated with Binance, involving Ethereum, Bitcoin, and TRON; if confirmed as a hack, it would become the largest cryptocurrency heist in history. Binance stated that it is still investigating.