News Heat Trend
Project Overview
Kyber Network is a multi-chain crypto trading and liquidity hub that connects liquidity from different sources to enable trades at the best rates.
Newton Foundation: Binance attacker mistakenly transferred tokens worth approximately $3.5 million into the NEWT contract, now permanently locked.
According to a post by the Newton Foundation (@NewtonFndn), the attacker involved in the recent Binance breach appears to have made an operational error, directly transferring approximately 8 million NEWT tokens, along with 17 other tokens (ANIME, ANKR, ARPA, BARD, CELR, DENT, DOLO, FTT, GLM, HIGH, HOT, KNC, LQTY, RARE, RESOLV, SIGN, WOO) to the NEWT token contract address (0xd0ec028a3d21533fdd200838f39c85b03679285d). Valued at current prices, the total amounts to approximately $3.5 million. The foundation stated that the NEWT token contract itself was not compromised. Featuring an immutable design with no owner or administrator, all management rights were relinquished on-chain in 2025, and upgrade functionality has been permanently disabled. As a result, no one, including the foundation, can retrieve these tokens.
Binance hacker suspected of making a mistake, possibly locatable via MetaMask Gas Station IP
Odaily reports: Smart contract developer Justin Kalland posted on X that the Binance hacker appears to have made a potential mistake, and MetaMask should retain as much of any Web2 logs as they can obtain.Specifically, the hacker sent 175 million USDT to a new wallet, and about 2.5 minutes later, that wallet also received 2 ETH. This was likely used to pay for Gas fees, consistent with the pattern used by their other attack wallets.Exactly two minutes after that, the wallet used MetaMask's Gas Station service, even though it already had Gas fees at the time. Three consecutive transactions landed in the same block — an ETH top-up from Gas Station, an infinite USDT approval to the Kyber Network router, and a payment of 127.67 USDT to Gas Station. The amount of the ETH top-up exactly matched the combined maximum Gas budget of the Kyber approval and the USDT payment. Accurate down to wei (the smallest Ethereum unit).But the problem is that the ETH they had at the time was already fully sufficient to cover both fees, so a reasonable speculation is that they were using a MetaMask wallet at the time and, due to haste, mistakenly selected USDT to pay for Gas fees. For convenience, MetaMask sometimes defaults to this method, and the order of top-ups within the same block also matches how its implementation mechanism works.To use Gas Station in MetaMask, users must use MetaMask Sentinel. This means the transactions were broadcast through them, rather than through a regular RPC. This interaction likely left off-chain records at MetaMask, which may include IP metadata.Among all the attacker's wallets that have been checked, this is the only wallet showing use of Gas Station, and the wallet address is: 0xAa246BF639586a6Ba46762D378CE50cA4fc654a0.
Newton Foundation: Binance attacker mistakenly transferred tokens worth approximately $3.5 million into the NEWT contract, now permanently locked.
According to a post by the Newton Foundation (@NewtonFndn), the attacker involved in the recent Binance breach appears to have made an operational error, directly transferring approximately 8 million NEWT tokens, along with 17 other tokens (ANIME, ANKR, ARPA, BARD, CELR, DENT, DOLO, FTT, GLM, HIGH, HOT, KNC, LQTY, RARE, RESOLV, SIGN, WOO) to the NEWT token contract address (0xd0ec028a3d21533fdd200838f39c85b03679285d). Valued at current prices, the total amounts to approximately $3.5 million. The foundation stated that the NEWT token contract itself was not compromised. Featuring an immutable design with no owner or administrator, all management rights were relinquished on-chain in 2025, and upgrade functionality has been permanently disabled. As a result, no one, including the foundation, can retrieve these tokens.
Binance hacker suspected of making a mistake, possibly locatable via MetaMask Gas Station IP
Odaily reports: Smart contract developer Justin Kalland posted on X that the Binance hacker appears to have made a potential mistake, and MetaMask should retain as much of any Web2 logs as they can obtain.Specifically, the hacker sent 175 million USDT to a new wallet, and about 2.5 minutes later, that wallet also received 2 ETH. This was likely used to pay for Gas fees, consistent with the pattern used by their other attack wallets.Exactly two minutes after that, the wallet used MetaMask's Gas Station service, even though it already had Gas fees at the time. Three consecutive transactions landed in the same block — an ETH top-up from Gas Station, an infinite USDT approval to the Kyber Network router, and a payment of 127.67 USDT to Gas Station. The amount of the ETH top-up exactly matched the combined maximum Gas budget of the Kyber approval and the USDT payment. Accurate down to wei (the smallest Ethereum unit).But the problem is that the ETH they had at the time was already fully sufficient to cover both fees, so a reasonable speculation is that they were using a MetaMask wallet at the time and, due to haste, mistakenly selected USDT to pay for Gas fees. For convenience, MetaMask sometimes defaults to this method, and the order of top-ups within the same block also matches how its implementation mechanism works.To use Gas Station in MetaMask, users must use MetaMask Sentinel. This means the transactions were broadcast through them, rather than through a regular RPC. This interaction likely left off-chain records at MetaMask, which may include IP metadata.Among all the attacker's wallets that have been checked, this is the only wallet showing use of Gas Station, and the wallet address is: 0xAa246BF639586a6Ba46762D378CE50cA4fc654a0.
Kyber Hacker Moves Stolen Funds to Tornado Cash, Hacker Previously Indicted by FBI
Odaily reports, according to Arkham monitoring, the Kyber Network hacker is transferring stolen funds into Tornado Cash. The hacker, Andean Medjedovic, stole $48.8 million from KyberSwap in late 2023. He had also previously attacked Indexed Finance and stolen $16.5 million. He was indicted by the FBI in 2025.
Newton Foundation: Binance attacker mistakenly transferred tokens worth approximately $3.5 million into the NEWT contract, now permanently locked.
According to a post by the Newton Foundation (@NewtonFndn), the attacker involved in the recent Binance breach appears to have made an operational error, directly transferring approximately 8 million NEWT tokens, along with 17 other tokens (ANIME, ANKR, ARPA, BARD, CELR, DENT, DOLO, FTT, GLM, HIGH, HOT, KNC, LQTY, RARE, RESOLV, SIGN, WOO) to the NEWT token contract address (0xd0ec028a3d21533fdd200838f39c85b03679285d). Valued at current prices, the total amounts to approximately $3.5 million. The foundation stated that the NEWT token contract itself was not compromised. Featuring an immutable design with no owner or administrator, all management rights were relinquished on-chain in 2025, and upgrade functionality has been permanently disabled. As a result, no one, including the foundation, can retrieve these tokens.
Binance to Delist Four Spot Trading Pairs Including GLM/BTC
According to an official announcement, Binance will remove and halt trading for the following spot trading pairs at 03:00 (UTC) on July 17, 2026: GLM/BTC, KNC/BTC, ONT/BTC, and XAI/USDC. Binance will simultaneously terminate the spot trading bot services for these pairs. Users are required to update or cancel related trading bots before this time to avoid potential losses. The delisting of these trading pairs does not affect the trading of the tokens on other trading pairs available on Binance.
Related news
Newton Foundation: Binance attacker mistakenly transferred tokens worth approximately $3.5 million into the NEWT contract, now permanently locked.
According to a post by the Newton Foundation (@NewtonFndn), the attacker involved in the recent Binance breach appears to have made an operational error, directly transferring approximately 8 million NEWT tokens, along with 17 other tokens (ANIME, ANKR, ARPA, BARD, CELR, DENT, DOLO, FTT, GLM, HIGH, HOT, KNC, LQTY, RARE, RESOLV, SIGN, WOO) to the NEWT token contract address (0xd0ec028a3d21533fdd200838f39c85b03679285d). Valued at current prices, the total amounts to approximately $3.5 million. The foundation stated that the NEWT token contract itself was not compromised. Featuring an immutable design with no owner or administrator, all management rights were relinquished on-chain in 2025, and upgrade functionality has been permanently disabled. As a result, no one, including the foundation, can retrieve these tokens.
Binance hacker suspected of making a mistake, possibly locatable via MetaMask Gas Station IP
Odaily reports: Smart contract developer Justin Kalland posted on X that the Binance hacker appears to have made a potential mistake, and MetaMask should retain as much of any Web2 logs as they can obtain.Specifically, the hacker sent 175 million USDT to a new wallet, and about 2.5 minutes later, that wallet also received 2 ETH. This was likely used to pay for Gas fees, consistent with the pattern used by their other attack wallets.Exactly two minutes after that, the wallet used MetaMask's Gas Station service, even though it already had Gas fees at the time. Three consecutive transactions landed in the same block — an ETH top-up from Gas Station, an infinite USDT approval to the Kyber Network router, and a payment of 127.67 USDT to Gas Station. The amount of the ETH top-up exactly matched the combined maximum Gas budget of the Kyber approval and the USDT payment. Accurate down to wei (the smallest Ethereum unit).But the problem is that the ETH they had at the time was already fully sufficient to cover both fees, so a reasonable speculation is that they were using a MetaMask wallet at the time and, due to haste, mistakenly selected USDT to pay for Gas fees. For convenience, MetaMask sometimes defaults to this method, and the order of top-ups within the same block also matches how its implementation mechanism works.To use Gas Station in MetaMask, users must use MetaMask Sentinel. This means the transactions were broadcast through them, rather than through a regular RPC. This interaction likely left off-chain records at MetaMask, which may include IP metadata.Among all the attacker's wallets that have been checked, this is the only wallet showing use of Gas Station, and the wallet address is: 0xAa246BF639586a6Ba46762D378CE50cA4fc654a0.
Binance to Delist Four Spot Trading Pairs Including GLM/BTC
According to an official announcement, Binance will remove and halt trading for the following spot trading pairs at 03:00 (UTC) on July 17, 2026: GLM/BTC, KNC/BTC, ONT/BTC, and XAI/USDC. Binance will simultaneously terminate the spot trading bot services for these pairs. Users are required to update or cancel related trading bots before this time to avoid potential losses. The delisting of these trading pairs does not affect the trading of the tokens on other trading pairs available on Binance.
Kyber Hacker Moves Stolen Funds to Tornado Cash, Hacker Previously Indicted by FBI
Odaily reports, according to Arkham monitoring, the Kyber Network hacker is transferring stolen funds into Tornado Cash. The hacker, Andean Medjedovic, stole $48.8 million from KyberSwap in late 2023. He had also previously attacked Indexed Finance and stolen $16.5 million. He was indicted by the FBI in 2025.
Ethereum Aggregator Competition Intensifies, Kyber and CowSwap Lead, 1inch's Share Declines
Odaily News The market landscape for DEX aggregators on Ethereum is shifting, moving from a structure dominated by a single protocol in the past to a more fragmented competitive landscape.Currently, Kyber Network holds the top position with approximately 31% market share, followed closely by CowSwap at around 22%, while 1inch's share has dropped from about 30% to 15%.Analysis suggests this change is related to the ebb of early liquidity mining incentives and also reflects a gradual shift in user behavior from being "incentive-driven" to being driven by "real trading experience."It is worth noting that the statistics only include transactions initiated directly through the aggregators and do not fully reflect the actual influence of protocols serving as underlying routing infrastructure.