News linked to both this project and an event.
Odaily reports: Crypto KOL Seven research posted that "right now, the vast majority of market makers and quantitative firms in the crypto market keep the bulk of their capital and main margin accounts on Binance. Many institutions engage in cross-exchange arbitrage or hedging, and Binance's suspension of withdrawals could cause their funding chains to seize up on the spot—if market volatility continues to intensify, they would be unable to withdraw funds from Binance to top up margin elsewhere. To avoid liquidation, they would be forced to close positions on other exchanges and on-chain, forcibly pulling cash back. This is also why, even though the assets stolen were Ethereum-ecosystem assets, Solana and a bunch of altcoins ended up crashing along with it today."
Odaily report: A wallet suspected to be associated with the Binance hack incident received tens of thousands of ETH through a Uniswap contract and borrowed 19,762 ETH on Aave using approximately $60 million in USDT as collateral. On-chain records do not show any vulnerabilities in Uniswap or Aave.As of 22:07 UTC, the two wallets held approximately 253,000 ETH, worth about $570 million, with no outgoing transfers recorded. Aave has paused the Ethereum mainnet V3 market, and Kamino has also paused borrowing in the SOL/BTC market; Ripple has frozen approximately $200 million in RLUSD, and more than $2 billion in USDT and USDC has been frozen by stablecoin issuers. (Decrypt)
According to Decrypt, Binance co-CEO He Yi stated that Ripple has frozen approximately $200 million in RLUSD; suspected hackers are converting freezeable stablecoins into ETH via Uniswap and Aave, while Kamino has suspended SOL/BTC market lending.
Solana ecosystem Meme coin free mika (MIKA) fell on October 28. Its genesis address transferred approximately 500.44 million tokens to another wallet, accounting for about half of the initial supply; about 7 seconds later, that wallet sold approximately 500.83 million MIKA on PumpSwap, and after the sale, the short-term trade price was about 99% lower than before. Some claim that the wallet nonce prevented the key holder from transferring funds, but the transfer used a normal recent blockhash, and it is currently still impossible to confirm whether the sale came from an external attack or an existing holder.
Odaily reports: According to on-chain detective Specter, the Bloom drainer stole nearly $1 million and moved the funds in a manner consistent with handling eight-figure amounts. The transaction patterns suggest the operation may have been automated, including repeated splitting, consolidation, and cross-chain transfers through thousands of addresses. The attacker used 2,152 unique routing and destination addresses, of which 1,326 were Solana addresses, 822 were EVM addresses, and 5 were Zcash addresses. The attacker also bridged to Zcash, with 26.099 ZEC entering the Sapling shielded pool.
Solflare stated that a security incident involving its SOL staking service provider has impacted the Solflare validator node keys held by that provider, and an investigation is currently underway. As a result, Solflare validator nodes are temporarily unable to generate staking rewards. Solflare emphasized that user-delegated SOL is stored in staking accounts controlled by users' own keys, and user funds remain unaffected.
According to SlowMist, its security personnel discovered during routine threat intelligence monitoring that the Udesk customer service system-related script udeskApi.2026-10-16.cached.js has been implanted with a malicious loader. The loader hides the address using hexadecimal encoding and asynchronously loads the remote script deeps.js (originating from udeskqlobal[.]com; note that the domain starts with the letter 'q'). This script reads page-accessible Cookie, localStorage, and sessionStorage data, intercepts form submissions and login/authentication requests, and sends the data to udeskqlobal[.]com/c.php, enabling attackers to hijack sessions or take over accounts. This data collection behavior is not restricted by target site policies, and unmatched pages may also be affected. According to SlowMist's analysis, the script also targets three categories of sites: mgbx[.]com, bikingex[.], and bitxex[.]io. It scans deposit pages every 200 milliseconds and replaces recognized deposit addresses with preset BTC, EVM, TRON, Solana, LTC, and DOGE addresses. Additionally, by wrapping the Clipboard API, replacing copy buttons, and intercepting copy events, the script ensures users only see and copy tampered addresses. If users transfer funds to these addresses, the assets will flow into the attacker's wallet.
Odaily reports: According to Onchain Lens monitoring, Bloomtrading users have reported wallet asset theft, with approximately $954,000 in funds transferred to a suspected theft address. A hacker stole 9,408 SOL from 49 victims through a theft wallet, and the final amount may be higher. The largest single theft was 1,636 SOL, worth approximately $166,000. Users are reminded to disconnect immediately and transfer funds to a new wallet.
according to Blockaid monitoring, the WAX multichain bridge on the WAX network is under attack, involving WAX, Solana, and Ethereum. The attacker withdrew mapped tokens on the WAX chain without paying the corresponding assets, while the bridge contracts on Solana and Ethereum still released the corresponding tokens. The attacker transferred approximately 52,986 USDC, 21,558 USDT, 840 DAI, 2.55 WETH, and 0.11 WBTC through 5 transactions. The scope of the incident's impact and whether losses are still expanding remain to be further confirmed.
According to Onchain Lens monitoring, the Drift Protocol attacker has become active again after 2 months, sending at least 13,400 ETH worth approximately $32 million to Tornado Cash, possibly to obscure the fund trail. The attacker still holds $225 million in assets across tracked wallets, including 93,965 ETH worth $224 million; 477,375 USDY worth approximately $549,000; and 1.33 SOL worth $138.
Odaily reports: Blockchain security research firm Asymmetric Research has disclosed that Solana's on-chain governance program svmgov previously had a vulnerability: when validators did not participate in voting, independent votes submitted in advance by their delegators might not be counted in the final results. The vulnerability was reported to the Solana Foundation on July 10 and was fixed on mainnet on August 3, earlier than the governance vote on August 24. Based on on-chain data calculations, Asymmetric Research estimates that if the vulnerability had not been fixed, the approval rate of the SGP-0002 proposal, which aims to accelerate the decline in SOL inflation, could have dropped from the actual 67.00% to 66.65%, below the 66.67% passage threshold. The vulnerability was fixed before the vote and did not actually change the proposal's outcome.
According to on-chain investigator vxdb, the Gamdom platform was targeted in a security attack. Preliminary data indicates that attackers stole approximately $2.2 million worth of assets across EVM-compatible chains, including Ethereum, BSC, Polygon, Arbitrum, and Optimism. Additionally, the Solana network suffered losses of around $965,000, while the TRON and Bitcoin networks each lost approximately $375,000 and $668,000, respectively. The total value stolen across all chains now exceeds $4.2 million.
According to Cointelegraph, Ethereum researcher Justin Drake warned that the rapid advancement of AI could accelerate mathematical attacks against the Elliptic Curve Digital Signature Algorithm (ECDSA), potentially breaking existing cryptographic systems within months under the worst-case scenario, and called on the industry to initiate "bunker mode"—transferring assets to new addresses with previously unexposed public keys to mitigate risk. Several industry insiders, however, expressed reservations. Coinbase Chief Cryptographer Yehuda Lindell stated there is currently "no evidence" that the mathematical assumptions underpinning ECDSA have been weakened; Trezor Bitcoin analyst Lucien Bourdon similarly noted that migrating assets could backfire and inadvertently create opportunities for scams. MetaMask founder Taylor Monahan was even more direct, asserting that if elliptic curve cryptography were truly compromised, "the entire world would go to zero," rendering bunker mode ineffective. Meanwhile, Ethereum has laid out a post-quantum roadmap based on hash-based signatures and ZK proofs, while public blockchains such as Solana and NEAR are also exploring their own quantum-safe alternatives, though concrete deployment timelines remain unset.
Jacob Creech, a developer at Anza, Solana's core development team, stated that Solana users need not be concerned about network security due to the accelerated advancement of quantum computing or AI-assisted traditional attacks, as Solana remains secure today and has a clear path forward to address these challenges.
Odaily News: Solana tokenized silver project Dominion has announced its shutdown. The team stated that a September security incident led to a large amount of SILV being exploited and sold off, followed by a liquidity collapse, loss of operating capital, and damage to market structure. The capital required for rebuilding now exceeds the project's remaining resources. Dominion has allocated most of its remaining liquid funds to a refund plan, allowing eligible pre-attack SILV holders to exit at $63 per token. SILV was originally designed as a Solana token backed 1:1 by physical silver, with each token corresponding to 1 troy ounce of silver. On September 11, attackers gained control of its 3/5 multisig keys and dumped approximately 46,900 SILV into a DEX with thin liquidity. The notional value before the attack was approximately $3 million, but only about $238,000 was ultimately cashed out.
Odaily News — According to on-chain analyst Yu Jin's monitoring, trader @frogmanhaha's wallet (0x14...5794, 9wMS...ov8z) was suspected of being hacked approximately 5 hours ago, with 9 types of assets worth about $4 million transferred, sold, and swapped into ETH, BNB, and SOL, then dispersed through tools such as Privacy Cash and Chainflip. The stolen assets mainly include 1.43 million BP, worth approximately $1.77 million; 13.96 million MarsCoin, worth approximately $1.55 million; and 3.7 million Cash Cat, worth approximately $510,000.
Odaily News: On-chain detective ZachXBT posted on X that he once posed as a client to infiltrate a criminal group suspected of laundering money for the North Korea-backed hacker organization Lazarus Group, and assisted in freezing funds related to the 2025 Bybit attack.ZachXBT stated that after Bybit suffered a $1.5 billion attack in February 2025, he discovered that more than 15 accounts in public Telegram and Discord groups were seeking help processing transactions related to the stolen funds. He subsequently contacted one of the Telegram users using the alias "Jimmy Green" and built trust through multiple transactions. According to his disclosure, on March 6, 2025, he transferred $3.497 million in USDC to an Ethereum address for a USDC-to-TRON-chain USDT exchange transaction with the counterparty. The source of gas funds for that address can be traced back to the Bybit attack funds and was publicly flagged as a Bybit attack blacklisted address.ZachXBT said that in subsequent communications, the counterparty revealed that their team had been involved in processing the stolen Bybit funds and disclosed in advance that the funds would be moved across chains including Solana. By matching transaction timing, amounts, and on-chain data, he identified a wallet cluster involving more than $12 million in Bybit attack funds, with fund paths spanning multiple networks including BTC→ETH→SOL→TRON. Approximately 442,000 USDT was frozen by Tether, and the group also attempted to launder money through Uniswap liquidity pools and low-liquidity tokens. Additionally, the counterparty disclosed having helped other clients process approximately $3 million in fraudulent proceeds, and ZachXBT traced the related funds to wallets associated with the sanctioned Huione Guarantee.ZachXBT revealed that in this investigation, he initially invested $3.497 million and bore a loss risk of approximately 5% per transaction. The intelligence ultimately obtained was provided to relevant investigative agencies and law enforcement authorities at the earliest opportunity. Since 2022, he has assisted in freezing over $75 million in funds related to North Korea-linked incidents.
victims of the Drift hack, a perpetual contract exchange on Solana, began filing claims on October 1. The recovery pool's initial funding stands at approximately $3.11 million against nearly $295.4 million in verified losses. Victims can redeem USDT through DFX tokens, with each $1 of loss converting to roughly 1.04 cents at launch, meaning a $1,000 loss corresponds to about $10.40.The total supply of DFX is fixed at 299,500,810.998 tokens, with each token corresponding to $1 of verified loss from the April incident, and no additional tokens will be minted. Holders can choose to burn DFX to redeem USDT, sell on secondary markets such as Raydium, or continue holding their claims. Completed redemptions are irreversible, and unclaimed tokens will expire after the claims window closes on January 1, 2028.Future funding for the recovery pool includes a portion of daily net protocol revenue from Velocity, the rebranded exchange rebuilt by Drift, up to $127.5 million in USDT committed by Tether, $20 million in USDT committed by strategic partners, and recovered stolen assets. On the first Friday after claims opened, approximately 216,480 DFX tokens were redeemed for about 2,250 USDT, with Velocity's first revenue transfer amounting to 31 USDT; approximately 13,025.9 ETH is spread across 4 Ethereum wallets, another approximately 2,309.4 ETH passed through Tornado Cash, and about $9.2 million in assets have been frozen at other addresses. (Bitcoin.com News)
Odaily reports: Cross-chain swap service Near Intents announced that the $3.8 million in funds stolen in a previous exploit has been fully returned, and the team has closed its investigation. Near Intents General Manager Alex Shevchenko had previously issued a 48-hour return deadline to the attacker, providing Bitcoin, BNB, Ethereum, and Solana addresses.The attacker acknowledged wrongdoing in an on-chain message, stating that all funds had been returned and urging others to report issues through the bug bounty program. The incident stemmed from a vulnerability in the interaction between its Omni deposit and withdrawal layer and the main smart contract. Near Intents had suspended services and promised full compensation to users. (Decrypt)
Odaily reports: Xie Jiaxin posted on X stating that this Bitget security incident involved multiple non-EVM chains and 10 tokens, and due to the different method of asset theft, different approaches to handling and restoring withdrawals were taken compared to last year's Bybit security incident in order to thoroughly eliminate potential risks.Additionally, Xie Jiaxin stated that he and Bitget CEO Gracy Chen will host a community livestream 30 minutes before withdrawals resume on Monday to discuss this security incident and answer community questions.Bitget announced on X that it will restore withdrawals in phases: Bitcoin network withdrawals will resume on September 28 at 8:00 (UTC); ETH withdrawals on Ethereum, BSC, Arbitrum, Base, and Optimism networks will resume on September 29 at 8:00 (UTC); USDT withdrawals on Ethereum, BSC, Solana, and Tron networks will resume on September 30 at 8:00 (UTC); other tokens, fiat, and P2P withdrawals will resume on October 2 at 8:00 (UTC). Trading and deposit services continue to operate normally, and users do not need to take any action in advance.