News Heat Trend
Project Overview
MetaMask is the world's popular unmanaged digital wallet and Web3 gateway.
Superlogic Acquires Entravel Crypto Business and Spree, Animoca Brands Becomes Strategic Investor
Odaily News: This acquisition will enhance Bookit's ability to provide crypto institutions with native travel and experience booking platform access services, and strengthen the tokenization capabilities of on-chain points and interoperable rewards. As part of the acquisition of Spree.Finance, Animoca Brands will become a strategic investor and shareholder of Superlogic, and its Chief Operating Officer Minh Do will join the Superlogic advisory board. Following the completion of the acquisition, the Bookit ecosystem will add 27 white-label partners including Kraken, MetaMask, and EtherFi, and open a travel, retail, and VIP experience network covering over 2 million merchants to partners and end users.
Entravel completes $7.5 million funding round, co-led by Ethereal Ventures and Finality Capital
Odaily News: Crypto travel platform Entravel has completed a $7.5 million funding round, co-led by Ethereal Ventures and Finality Capital, with participation from GSR, Varrock, G1 Ventures, Seier Capital, Veris Ventures, Funfair Ventures, and WTG Ventures.Entravel provides travel booking systems for over 40 brands including Kraken and MetaMask, covering 300 million users with an average booking conversion rate exceeding 10%. The company was founded in 2026. (Tech Funding News)
Crypto companies pause IPO plans amid declining trading volumes and AI-driven reshaping of the tech market
: Due to weak trading volumes and macro pressures weighing on valuations, crypto companies are pausing their long-awaited IPO plans. Hardware wallet manufacturer Ledger and MetaMask developer ConsenSys are among the companies that have delayed their IPOs. Ledger had previously planned to list on the New York Stock Exchange with a valuation of $4 billion.Sean Farrell, Head of Digital Asset Strategy at Fundstrat, stated that crypto trading volumes have fallen by approximately 75% year-to-date, putting pressure on the valuations of publicly listed crypto companies. In contrast, demand for IPOs from tech companies related to AI remains strong.Additionally, Bitcoin miners pivoting to AI infrastructure have become one of the better-performing segments in the crypto market. Sean Farrell also pointed out that Hyperliquid is one of the standout crypto ecosystems in 2026, generating approximately $850 million in revenue over the past 12 months. Its recent partnership with Coinbase has made USDC the canonical stablecoin on the platform. (coindesk)
Consensys: Delays IPO Plans to Earliest This Fall Amid Market Conditions
according to sources familiar with the matter, MetaMask developer Consensys has postponed its U.S. IPO plans to earliest this fall. The company originally planned to submit a draft S-1 filing with the SEC by the end of February, but market demand weakened due to the market downturn in February, macroeconomic uncertainty, and Bitcoin ETF outflows. Besides Consensys, Kraken and Ledger have also paused their IPO plans.Consensys completed a $450 million funding round in 2022 at a valuation of $7 billion. Additionally, BitGo, which was the first crypto company to go public in 2026, raised $213 million but has since seen its stock price drop 36% from its $18 offering price, reflecting the public market's cautious approach toward valuing crypto infrastructure companies.
Joseph Lubin: Some infrastructure experienced a security incident; MetaMask wallets and user funds remain unaffected.
Consensys founder Joseph Lubin stated in a post that the team has recently addressed and resolved a security incident impacting some infrastructure. Based on current investigation results, there is no indication that the MetaMask wallet or user funds within it were affected. The mnemonic phrase, private keys, and wallet assets were not compromised in this incident, and users retain full control over their assets.
SlowMist Yuxian: MetaMask Staking Node Issue Typically Does Not Affect ETH Principal
SlowMist founder Yu Xian stated that MetaMask Staking preemptively exited from the Lido validator set following an investigation into an infrastructure breach. Issues of this nature with staking nodes generally do not affect the ETH principal, but may impact staking rewards.
MetaMask Staking Exits Lido Validators, Expected to Take Up to 45 Days to Gradually Recover
Lido stated that MetaMask Staking has taken precautionary measures and exited its operated Lido Ethereum validators following an investigation into an infrastructure intrusion incident, with the related ETH expected to gradually return to the protocol over a period of up to approximately 45 days.
Specter: A MetaMask Swap Router Contract Address Has Been Blacklisted by Tether Since 2021
blockchain security researcher Specter has stated that while investigating the Payy Network attack incident, he discovered that an address associated with a MetaMask Swap router contract was blacklisted by Tether in 2021 and has remained blacklisted ever since. Specter said he had not previously noticed this situation.
MetaMask team infiltrated by North Korean hacker aftermath: hacker's identity was publicly exposed as early as September 2025, yet still bypassed background checks to enter MetaMask through outsourcing in March this year
that, according to DeFi researcher @Zun2025 posted on X platform, "MetaMask hired a DPRK-linked hacker as a developer without even conducting a proper background check that could have revealed his identity.The hacker's GitHub username is imyugioh, and he has been publicly listed on the Lazarus Group website since September 2025, yet MetaMask still hired this individual in March 2026. Source: lazarus.group/team/mauro-liu. Imagine that one of the largest wallets granted core code repository access to someone already on a publicly known list of DPRK hackers. Now think about what might happen to those small protocols with absolutely no security teams."Earlier reports stated that a North Korean hacker, Tyler Knapp, infiltrated the MetaMask team. He entered MetaMask through a long-term cooperating human resources supplier via an outsourcing arrangement, bypassing the background checks of the company's direct recruitment process. He worked at the company for a month and participated in the development of the wallet's fiat on/off ramp functionality. During this period, his IP address and behavioral anomalies were detected by the company's security monitoring. The company immediately revoked all his access permissions and suspended the release of all products he had worked on. No substantial data or financial losses have been caused so far.
MetaMask Launches AI Agent Self-Custody Wallet "Agent Wallet", Supporting Multi-Chain Automated Trading
MetaMask has officially launched Agent Wallet, a self-custody wallet designed for AI agents. It enables automated trading, perpetual contracts, and liquidity provision on Ethereum, multiple EVM-compatible chains, and the Hyperliquid network. The product is equipped with multiple security mechanisms, including transaction simulation, spending limits, and address whitelisting. It integrates with Blockaid's risk scanning, requiring user secondary confirmation for high-risk transactions. The platform also introduces a transaction guarantee service, offering up to $10,000 in compensation for compliant and secure transactions. Currently, the product is only being tested by a small group of users via the command line, with plans for a full public release this summer. (The Block)
EIP-7702 Developer: EIP-7702 Itself Has No Vulnerability, But It Did Help the Hacker in the Binance Incident
Odaily Report: Derek Chiang, founder of ZeroDev and a developer involved with EIP-7702, posted on X stating that first, to be clear — EIP-7702 itself has no vulnerability. If you are using a wallet that supports EIP-7702 (MetaMask, Uniswap, Ambire, etc.), please do not panic.EIP-7702 is an Account Abstraction improvement proposal that allows externally owned accounts (EOAs) to sign a special message called a "7702 authorization," thereby embedding a smart contract into that account. This enables accounts to achieve powerful functionality, such as transaction batching — combining "authorization" and "transfer" into a single transaction, allowing you to complete a swap on Uniswap with just one click.Unfortunately, the same feature also allows hackers to efficiently transfer all your tokens in a single transaction. In the Binance hack incident, the hacker moved ETH, USDT, and 62 other tokens in one transaction, whereas without EIP-7702, they would have needed to send a separate transaction for each token. In this particular incident, many such transactions would have failed anyway, because Binance was still using the compromised wallet for withdrawals at the time, so all transactions sent by the hacker had to compete with legitimate transactions for Nonce (transaction sequence number). Therefore, using EIP-7702 did help the hacker steal funds as quickly and as extensively as possible.However, for the hacker to use EIP-7702, one of the following conditions must have been met: first, they obtained the private key; second, they tricked Binance into signing a 7702 authorization — the latter is highly unlikely, as it is hard to imagine Binance exposing an endpoint used for signing 7702 authorizations (or worse, signing raw messages that could be repackaged by the hacker for 7702 authorization). But until the official postmortem report is released, this possibility cannot be completely ruled out.Derek Chiang added: "As one of the contributors to account abstraction, I feel somewhat responsible for this hack incident, because while giving accounts more powerful functionality, we have indeed also given hackers stronger capabilities."
Binance hacker suspected of making a mistake, possibly locatable via MetaMask Gas Station IP
Odaily reports: Smart contract developer Justin Kalland posted on X that the Binance hacker appears to have made a potential mistake, and MetaMask should retain as much of any Web2 logs as they can obtain.Specifically, the hacker sent 175 million USDT to a new wallet, and about 2.5 minutes later, that wallet also received 2 ETH. This was likely used to pay for Gas fees, consistent with the pattern used by their other attack wallets.Exactly two minutes after that, the wallet used MetaMask's Gas Station service, even though it already had Gas fees at the time. Three consecutive transactions landed in the same block — an ETH top-up from Gas Station, an infinite USDT approval to the Kyber Network router, and a payment of 127.67 USDT to Gas Station. The amount of the ETH top-up exactly matched the combined maximum Gas budget of the Kyber approval and the USDT payment. Accurate down to wei (the smallest Ethereum unit).But the problem is that the ETH they had at the time was already fully sufficient to cover both fees, so a reasonable speculation is that they were using a MetaMask wallet at the time and, due to haste, mistakenly selected USDT to pay for Gas fees. For convenience, MetaMask sometimes defaults to this method, and the order of top-ups within the same block also matches how its implementation mechanism works.To use Gas Station in MetaMask, users must use MetaMask Sentinel. This means the transactions were broadcast through them, rather than through a regular RPC. This interaction likely left off-chain records at MetaMask, which may include IP metadata.Among all the attacker's wallets that have been checked, this is the only wallet showing use of Gas Station, and the wallet address is: 0xAa246BF639586a6Ba46762D378CE50cA4fc654a0.
AI Could Break Encryption Algorithms, Ethereum Researchers Call for "Bunker Mode"
According to Cointelegraph, Ethereum researcher Justin Drake warned that the rapid advancement of AI could accelerate mathematical attacks against the Elliptic Curve Digital Signature Algorithm (ECDSA), potentially breaking existing cryptographic systems within months under the worst-case scenario, and called on the industry to initiate "bunker mode"—transferring assets to new addresses with previously unexposed public keys to mitigate risk. Several industry insiders, however, expressed reservations. Coinbase Chief Cryptographer Yehuda Lindell stated there is currently "no evidence" that the mathematical assumptions underpinning ECDSA have been weakened; Trezor Bitcoin analyst Lucien Bourdon similarly noted that migrating assets could backfire and inadvertently create opportunities for scams. MetaMask founder Taylor Monahan was even more direct, asserting that if elliptic curve cryptography were truly compromised, "the entire world would go to zero," rendering bunker mode ineffective. Meanwhile, Ethereum has laid out a post-quantum roadmap based on hash-based signatures and ZK proofs, while public blockchains such as Solana and NEAR are also exploring their own quantum-safe alternatives, though concrete deployment timelines remain unset.
Cash App Expands Crypto Support via MoonPay, 50 Million Users Can Buy ETH, SOL, XRP, and USDT
Odaily News: Payment app Cash App is expanding its cryptocurrency services through crypto payment platform MoonPay, allowing 50 million users to purchase tokens such as ETH, SOL, XRP, and USDT. Additionally, users can top up major wallets like Ledger, BitPay, Trust Wallet, MetaMask, and Uniswap through Cash App. Previously, Cash App's crypto services only supported Bitcoin, with USDC support added earlier this year. (CoinDesk)
Robinhood Chain Sees Single-Day DEX Volume Exceed $560 Million, CASHCAT Market Cap Hits $100 Million in Five Hours
on-chain analyst Ai Yi posted on Platform X, stating that Memecoins are becoming the primary traffic gateway for Robinhood Chain. CASHCAT reached a market cap of $100 million within five hours, and Robinhood CEO @vladtenev participated in related discussions. Robinhood Chain saw over 10,000 new tokens launched in a single day, with DEX trading volume exceeding $560 million. Robinhood Chain is an L2 network. Users can add the network via wallets such as OKX, Binance, and MetaMask, with Chain ID 4663. The official Robinhood Wallet is available on iOS and Android mobile apps and features cross-chain functionality. Cross-chain methods on Robinhood Chain include the official cross-chain bridge, Robinhood Wallet, and third-party aggregators like Relay, Stargate, and Across. Withdrawals via the official cross-chain bridge have a 7-day waiting period. DEXs on the Robinhood Chain ecosystem include Uniswap and NOXA Fun. Meme tracking tools include DEXScreener and GMGN.
B.AI Officially Integrates with the Solana Ecosystem, Expanding Multi-Chain Coverage to Eight Major Public Blockchains
B.AI has officially integrated into the Solana ecosystem, comprehensively upgrading its cross-chain login and payment capabilities. Users can now log in with one click via MetaMask and Phantom wallets and top up or subscribe using SOL, USDT, USDC, or WBTC on the Solana network. B.AI now supports eight major public blockchains—TRON, BNB Chain, Ethereum, Base, Arbitrum, Optimism, Polygon, and Solana—building a more open and decentralized multi-chain AI economy. New users enjoy an exclusive limited-time welcome offer: 500,000 points upon first login, a 1:1 bonus on top-ups, and up to an additional $100 worth of points per user. Going forward, B.AI will lower entry barriers and expand asset options to help you seamlessly enter the new era of intelligent economics.
EIP-7702 Developer: EIP-7702 Itself Has No Vulnerability, But It Did Help the Hacker in the Binance Incident
Odaily Report: Derek Chiang, founder of ZeroDev and a developer involved with EIP-7702, posted on X stating that first, to be clear — EIP-7702 itself has no vulnerability. If you are using a wallet that supports EIP-7702 (MetaMask, Uniswap, Ambire, etc.), please do not panic.EIP-7702 is an Account Abstraction improvement proposal that allows externally owned accounts (EOAs) to sign a special message called a "7702 authorization," thereby embedding a smart contract into that account. This enables accounts to achieve powerful functionality, such as transaction batching — combining "authorization" and "transfer" into a single transaction, allowing you to complete a swap on Uniswap with just one click.Unfortunately, the same feature also allows hackers to efficiently transfer all your tokens in a single transaction. In the Binance hack incident, the hacker moved ETH, USDT, and 62 other tokens in one transaction, whereas without EIP-7702, they would have needed to send a separate transaction for each token. In this particular incident, many such transactions would have failed anyway, because Binance was still using the compromised wallet for withdrawals at the time, so all transactions sent by the hacker had to compete with legitimate transactions for Nonce (transaction sequence number). Therefore, using EIP-7702 did help the hacker steal funds as quickly and as extensively as possible.However, for the hacker to use EIP-7702, one of the following conditions must have been met: first, they obtained the private key; second, they tricked Binance into signing a 7702 authorization — the latter is highly unlikely, as it is hard to imagine Binance exposing an endpoint used for signing 7702 authorizations (or worse, signing raw messages that could be repackaged by the hacker for 7702 authorization). But until the official postmortem report is released, this possibility cannot be completely ruled out.Derek Chiang added: "As one of the contributors to account abstraction, I feel somewhat responsible for this hack incident, because while giving accounts more powerful functionality, we have indeed also given hackers stronger capabilities."
Binance hacker suspected of making a mistake, possibly locatable via MetaMask Gas Station IP
Odaily reports: Smart contract developer Justin Kalland posted on X that the Binance hacker appears to have made a potential mistake, and MetaMask should retain as much of any Web2 logs as they can obtain.Specifically, the hacker sent 175 million USDT to a new wallet, and about 2.5 minutes later, that wallet also received 2 ETH. This was likely used to pay for Gas fees, consistent with the pattern used by their other attack wallets.Exactly two minutes after that, the wallet used MetaMask's Gas Station service, even though it already had Gas fees at the time. Three consecutive transactions landed in the same block — an ETH top-up from Gas Station, an infinite USDT approval to the Kyber Network router, and a payment of 127.67 USDT to Gas Station. The amount of the ETH top-up exactly matched the combined maximum Gas budget of the Kyber approval and the USDT payment. Accurate down to wei (the smallest Ethereum unit).But the problem is that the ETH they had at the time was already fully sufficient to cover both fees, so a reasonable speculation is that they were using a MetaMask wallet at the time and, due to haste, mistakenly selected USDT to pay for Gas fees. For convenience, MetaMask sometimes defaults to this method, and the order of top-ups within the same block also matches how its implementation mechanism works.To use Gas Station in MetaMask, users must use MetaMask Sentinel. This means the transactions were broadcast through them, rather than through a regular RPC. This interaction likely left off-chain records at MetaMask, which may include IP metadata.Among all the attacker's wallets that have been checked, this is the only wallet showing use of Gas Station, and the wallet address is: 0xAa246BF639586a6Ba46762D378CE50cA4fc654a0.
AI Could Break Encryption Algorithms, Ethereum Researchers Call for "Bunker Mode"
According to Cointelegraph, Ethereum researcher Justin Drake warned that the rapid advancement of AI could accelerate mathematical attacks against the Elliptic Curve Digital Signature Algorithm (ECDSA), potentially breaking existing cryptographic systems within months under the worst-case scenario, and called on the industry to initiate "bunker mode"—transferring assets to new addresses with previously unexposed public keys to mitigate risk. Several industry insiders, however, expressed reservations. Coinbase Chief Cryptographer Yehuda Lindell stated there is currently "no evidence" that the mathematical assumptions underpinning ECDSA have been weakened; Trezor Bitcoin analyst Lucien Bourdon similarly noted that migrating assets could backfire and inadvertently create opportunities for scams. MetaMask founder Taylor Monahan was even more direct, asserting that if elliptic curve cryptography were truly compromised, "the entire world would go to zero," rendering bunker mode ineffective. Meanwhile, Ethereum has laid out a post-quantum roadmap based on hash-based signatures and ZK proofs, while public blockchains such as Solana and NEAR are also exploring their own quantum-safe alternatives, though concrete deployment timelines remain unset.
Revoke.cash Notice: Ultimate subscription users need to check Auto-Revoking settings.
Revoke.cash issued a reminder stating that, following last week's Magic Eden security incident, Ultimate subscribers must ensure their wallets meet two conditions for the Auto-Revoking feature to properly protect assets: first, granting Auto-Revoking permissions for the wallet in MetaMask; second, the wallet has been upgraded to a MetaMask Smart Account on the corresponding network. The second step is normally completed automatically during the authorization process, but if the address had already been upgraded to a Smart Account via another wallet application, the upgrade may fail.
Joseph Lubin: Some infrastructure experienced a security incident; MetaMask wallets and user funds remain unaffected.
Consensys founder Joseph Lubin stated in a post that the team has recently addressed and resolved a security incident impacting some infrastructure. Based on current investigation results, there is no indication that the MetaMask wallet or user funds within it were affected. The mnemonic phrase, private keys, and wallet assets were not compromised in this incident, and users retain full control over their assets.
MetaMask Responds to Security Incident: Exits Affected Validator Nodes, Wallet and Funds Unaffected
MetaMask announced it is exiting the affected validator nodes in its non-custodial staking service, and there are currently no signs that wallets or customer funds have been compromised.
EIP-7702 Developer: EIP-7702 Itself Has No Vulnerability, But It Did Help the Hacker in the Binance Incident
Odaily Report: Derek Chiang, founder of ZeroDev and a developer involved with EIP-7702, posted on X stating that first, to be clear — EIP-7702 itself has no vulnerability. If you are using a wallet that supports EIP-7702 (MetaMask, Uniswap, Ambire, etc.), please do not panic.EIP-7702 is an Account Abstraction improvement proposal that allows externally owned accounts (EOAs) to sign a special message called a "7702 authorization," thereby embedding a smart contract into that account. This enables accounts to achieve powerful functionality, such as transaction batching — combining "authorization" and "transfer" into a single transaction, allowing you to complete a swap on Uniswap with just one click.Unfortunately, the same feature also allows hackers to efficiently transfer all your tokens in a single transaction. In the Binance hack incident, the hacker moved ETH, USDT, and 62 other tokens in one transaction, whereas without EIP-7702, they would have needed to send a separate transaction for each token. In this particular incident, many such transactions would have failed anyway, because Binance was still using the compromised wallet for withdrawals at the time, so all transactions sent by the hacker had to compete with legitimate transactions for Nonce (transaction sequence number). Therefore, using EIP-7702 did help the hacker steal funds as quickly and as extensively as possible.However, for the hacker to use EIP-7702, one of the following conditions must have been met: first, they obtained the private key; second, they tricked Binance into signing a 7702 authorization — the latter is highly unlikely, as it is hard to imagine Binance exposing an endpoint used for signing 7702 authorizations (or worse, signing raw messages that could be repackaged by the hacker for 7702 authorization). But until the official postmortem report is released, this possibility cannot be completely ruled out.Derek Chiang added: "As one of the contributors to account abstraction, I feel somewhat responsible for this hack incident, because while giving accounts more powerful functionality, we have indeed also given hackers stronger capabilities."
MetaMask Sets Stellar as Default Network on Mobile and Extension
MetaMask has set Stellar as the default network on its mobile app and browser extension. Existing multi-chain accounts will receive a Stellar address derived from their seed phrase, with support for XLM, USDC, and Soroban tokens.
Zerohash launches AUTH transfer service, enabling users to move crypto assets without copying wallet addresses.
According to CoinDesk, crypto infrastructure provider Zerohash has launched its AUTH service at the Money20/20 conference held in Las Vegas. When transferring crypto assets between linked exchange accounts and self-custody wallets, users no longer need to copy wallet addresses or select blockchain networks. The service supports cryptocurrencies, stablecoins, and on-chain securities such as tokenized stocks, and can connect to more than 600 accounts and wallets, including Coinbase, Robinhood, Gemini, MetaMask, and Phantom, while Kraken remains in beta testing. Ryan Bordery, General Manager of AUTH, previously served as Executive Vice President of Open Finance Global Products and Operations at Mastercard.
MetaMask Agent wallet is now live on Grok Bot
Odaily report: MetaMask posted on the X platform that the MetaMask Agent wallet is now live on Grok Bot. This wallet utilizes the same technology as the security mechanisms that protect millions of MetaMask users.
Revoke.cash Notice: Ultimate subscription users need to check Auto-Revoking settings.
Revoke.cash issued a reminder stating that, following last week's Magic Eden security incident, Ultimate subscribers must ensure their wallets meet two conditions for the Auto-Revoking feature to properly protect assets: first, granting Auto-Revoking permissions for the wallet in MetaMask; second, the wallet has been upgraded to a MetaMask Smart Account on the corresponding network. The second step is normally completed automatically during the authorization process, but if the address had already been upgraded to a Smart Account via another wallet application, the upgrade may fail.
Linea: MetaMask incident affects some Yield Boost validators, staking vault funds and control unaffected
Odaily report: Linea stated on X that, due to the MetaMask staking incident, some validators supporting the Yield Boost vault are exiting as a precautionary measure. The staking vault funds and control have not been affected; during the period when the relevant validators exit and are replaced by new validators, the net staking rewards funding ecosystem incentives will temporarily decrease.
Related news
EIP-7702 Developer: EIP-7702 Itself Has No Vulnerability, But It Did Help the Hacker in the Binance Incident
Odaily Report: Derek Chiang, founder of ZeroDev and a developer involved with EIP-7702, posted on X stating that first, to be clear — EIP-7702 itself has no vulnerability. If you are using a wallet that supports EIP-7702 (MetaMask, Uniswap, Ambire, etc.), please do not panic.EIP-7702 is an Account Abstraction improvement proposal that allows externally owned accounts (EOAs) to sign a special message called a "7702 authorization," thereby embedding a smart contract into that account. This enables accounts to achieve powerful functionality, such as transaction batching — combining "authorization" and "transfer" into a single transaction, allowing you to complete a swap on Uniswap with just one click.Unfortunately, the same feature also allows hackers to efficiently transfer all your tokens in a single transaction. In the Binance hack incident, the hacker moved ETH, USDT, and 62 other tokens in one transaction, whereas without EIP-7702, they would have needed to send a separate transaction for each token. In this particular incident, many such transactions would have failed anyway, because Binance was still using the compromised wallet for withdrawals at the time, so all transactions sent by the hacker had to compete with legitimate transactions for Nonce (transaction sequence number). Therefore, using EIP-7702 did help the hacker steal funds as quickly and as extensively as possible.However, for the hacker to use EIP-7702, one of the following conditions must have been met: first, they obtained the private key; second, they tricked Binance into signing a 7702 authorization — the latter is highly unlikely, as it is hard to imagine Binance exposing an endpoint used for signing 7702 authorizations (or worse, signing raw messages that could be repackaged by the hacker for 7702 authorization). But until the official postmortem report is released, this possibility cannot be completely ruled out.Derek Chiang added: "As one of the contributors to account abstraction, I feel somewhat responsible for this hack incident, because while giving accounts more powerful functionality, we have indeed also given hackers stronger capabilities."
Binance hacker suspected of making a mistake, possibly locatable via MetaMask Gas Station IP
Odaily reports: Smart contract developer Justin Kalland posted on X that the Binance hacker appears to have made a potential mistake, and MetaMask should retain as much of any Web2 logs as they can obtain.Specifically, the hacker sent 175 million USDT to a new wallet, and about 2.5 minutes later, that wallet also received 2 ETH. This was likely used to pay for Gas fees, consistent with the pattern used by their other attack wallets.Exactly two minutes after that, the wallet used MetaMask's Gas Station service, even though it already had Gas fees at the time. Three consecutive transactions landed in the same block — an ETH top-up from Gas Station, an infinite USDT approval to the Kyber Network router, and a payment of 127.67 USDT to Gas Station. The amount of the ETH top-up exactly matched the combined maximum Gas budget of the Kyber approval and the USDT payment. Accurate down to wei (the smallest Ethereum unit).But the problem is that the ETH they had at the time was already fully sufficient to cover both fees, so a reasonable speculation is that they were using a MetaMask wallet at the time and, due to haste, mistakenly selected USDT to pay for Gas fees. For convenience, MetaMask sometimes defaults to this method, and the order of top-ups within the same block also matches how its implementation mechanism works.To use Gas Station in MetaMask, users must use MetaMask Sentinel. This means the transactions were broadcast through them, rather than through a regular RPC. This interaction likely left off-chain records at MetaMask, which may include IP metadata.Among all the attacker's wallets that have been checked, this is the only wallet showing use of Gas Station, and the wallet address is: 0xAa246BF639586a6Ba46762D378CE50cA4fc654a0.
MetaMask Sets Stellar as Default Network on Mobile and Extension
MetaMask has set Stellar as the default network on its mobile app and browser extension. Existing multi-chain accounts will receive a Stellar address derived from their seed phrase, with support for XLM, USDC, and Soroban tokens.
Zerohash launches AUTH transfer service, enabling users to move crypto assets without copying wallet addresses.
According to CoinDesk, crypto infrastructure provider Zerohash has launched its AUTH service at the Money20/20 conference held in Las Vegas. When transferring crypto assets between linked exchange accounts and self-custody wallets, users no longer need to copy wallet addresses or select blockchain networks. The service supports cryptocurrencies, stablecoins, and on-chain securities such as tokenized stocks, and can connect to more than 600 accounts and wallets, including Coinbase, Robinhood, Gemini, MetaMask, and Phantom, while Kraken remains in beta testing. Ryan Bordery, General Manager of AUTH, previously served as Executive Vice President of Open Finance Global Products and Operations at Mastercard.
400,000 retail traders accessed Hyperliquid through third-party apps, incurring cumulative losses of $280 million, with app fees exceeding trading losses
Odaily Report: 6thManVentures investor Mike Dudas posted on X, citing Hyperdash data, stating that 400,000 retail traders who accessed Hyperliquid through third-party apps (Phantom, MetaMask, fomo, etc.) incurred cumulative losses of $280 million, with losses from app fees exceeding trading losses. Moreover, most retail traders stopped trading after incurring losses, resulting in extremely low user retention rates.
OneKey Founder: SafeOS is Built on FreeRTOS, Compatibility to Continue Expanding
OneKey founder Yishi stated in a post that OneKey's SafeOS is built on FreeRTOS and independently developed by the team. OneKey will always focus on portable security devices, providing additional offline hardware security protection for real-world assets (RWA), crypto assets, as well as FIDO keys and two-factor authentication (2FA). Yishi also emphasized that OneKey will serve as a universal accessory for iPhone and Mac, allowing users to pair OneKey with wallets such as BlueWallet, Sparrow, Rabby, OKX Wallet, MetaMask, Electrum, and more. The team will continue to expand its compatibility range.