News linked to both this project and an event.
LlamaRisk disclosed that Aave is unfreezing markets frozen due to the Binance hack in four phases. The v3 frozen reserves have already been unfrozen, while hacker-held assets such as USDT and USDC cannot currently be used for new borrowings against collateral.
Odaily report: Analysts from three Wall Street firms—Cantor Fitzgerald, TD Cowen, and Compass Point—all believe that despite Binance suffering an approximately $6.3 billion hack, there is currently insufficient evidence to suggest the incident will threaten the broader crypto market, and the market's prior recovery trend is unlikely to be interrupted as a result.Cantor Fitzgerald analyst Ramsey El-Assal noted that Tether has frozen over $1.5 billion in stolen assets, Circle has frozen approximately $800 million, and Ripple has frozen about $200 million, with Binance stating that the total frozen stolen funds currently amount to roughly $3 billion. He believes the crypto industry is gradually improving its ability to respond to such security incidents and expects crypto-related stocks such as Coinbase, Robinhood, and Strategy to rebound once market panic subsides, recommending that investors buy on the dip.TD Cowen analyst Lance Vitanza believes the attack exposed security weaknesses in Binance's own transaction signing infrastructure rather than flaws in the underlying technology of cryptocurrencies like Bitcoin, and that the market sell-off may present an opportunity to accumulate Bitcoin and shares of listed companies holding Bitcoin.Compass Point analysts believe Binance has sufficient liquidity to cover the funding gap, and expect its excess USDT reserves, BTC reserves, and USDC funds to be adequate to absorb the losses. However, the firm also warned that Binance compensating customers could put pressure on stablecoin supply and may drive users to migrate from centralized exchanges to competing platforms such as Coinbase, Bullish, and Hyperliquid. (CoinDesk)
Aave officially stated that the precautionary freeze measures taken following the Binance security incident have now been lifted, and all markets on Aave V3 and V4 have returned to normal. Previously, after receiving initial information about the incident, Aave paused new deposits and borrowings, but users could still withdraw assets and repay loans normally. Aave emphasized that its smart contracts were not affected by the incident, and user positions remained fully collateralized at all times. As an ongoing precautionary measure, the LTV of USDT, USDC, USDT0, POL, WAVAX, sAVAX, XAUT, PAXG, and OP will temporarily remain at 0, and these assets cannot be used as collateral for new borrowings.
Odaily report: Crypto analyst Darkfost posted that although Binance yesterday suffered an attack suspected to be linked to the North Korean hacker group Lazarus Group, with losses of approximately $6.3 billion—the largest theft in crypto industry history—the platform's reserve assets only declined modestly, and the impact on users appears limited.Data shows that during the attack, Binance saw outflows of 18,279 BTC, 185 million XRP, and $1.67 billion USDT at one point; ETH flowed out in two batches, totaling 246,840 coins (167,464 and 79,376 respectively). Based on same-day reserve changes, BTC reserves fell 3.1% to over 682,000 coins, ETH dropped 8.5% to 3.3 million coins, XRP declined 8% to 2.47 billion coins, and USDT decreased 6.3% to $34.1 billion.Additionally, Binance stated it has frozen approximately $3 billion in related assets, including $1.567 billion USDT and over $800 million USDC, and pledged to absorb losses through the SAFU fund and company reserves. Darkfost believes the magnitude of change in Binance's reserve assets indicates the platform still possesses a certain capacity to absorb shocks.
Odaily reports: Some market observers suggest that following the approximately $6.3 billion hack on Binance, project teams, VCs, and associated wallets may temporarily hold off on selling their altcoin holdings. In the coming days, funds, insiders, and project-affiliated wallets may exercise greater caution before selling tokens into the market to avoid further exacerbating selling pressure.Blockchain analytics firms TRM Labs and Chainalysis have both attributed the attack to North Korea with high confidence. Binance has committed to covering user losses through its protection fund and company resources, and approximately $3 billion in stolen assets have been located, with about half frozen through stablecoin issuers such as Tether and Circle. Market analysts note that the incident has once again sparked discussions around the security of centralized trading platforms, the freezing capabilities of stablecoins, and the difficulty of tracking decentralized assets. (zerohedge)
HTX Research analyst Chloe noted that this week, the cryptocurrency market faced a dual shock from expectations of macro tightening and the Binance security incident, causing short-term risk appetite to drop significantly. BTC briefly dipped below $77,000, triggering approximately $1.55 billion in liquidations across the market within 24 hours, including around $1.34 billion in long positions. Reports indicate the security incident involves assets totaling approximately $6.3 billion, with institutions like Tether and Circle assisting in freezing roughly $3 billion of the related funds. Binance has also committed to covering user losses, but the progress of the incident's resolution will continue to dictate the pace of market sentiment recovery.
Some users are concerned that freezing protocol collateral funds could trigger cascading liquidations in DeFi. He Yi's reply clarified the situation regarding AAVE-related collateral funds: currently, the 60 million USDT collateralized in AAVE falls outside the full freeze scope, and the hackers actually only stole approximately $46 million worth of ETH. Once these assets are unfrozen through the law enforcement system, an additional ~$14 million in recoverable assets will be available.
Odaily reports: An empirical study presented at USENIX Security 2026 shows that among the approximately 3.66 million early EIP-7702 authorization transactions across seven chains, about 63% were associated with malicious contracts; confirmed losses exceed $2.3 million, and 924 malicious contracts were identified. Most attacks use phishing to trick users into signing authorizations that delegate their wallets to sweeper contracts. On-chain analysis shows that in today's anomalous outflow event from Binance hot wallets, attackers exploited EIP-7702 authorizations signed by hot wallets including Binance 14 to delegate accounts to pre-deployed malicious sweeper contracts, then transferred assets in bulk within minutes. Estimates from multiple parties put the scale in the billions of dollars, and Tether, Circle, and others have frozen some stablecoins. This incident aligns with the risks identified in the research: whether through private key leakage or abuse of signing systems, once attackers obtain a legitimate authorization signature, EIP-7702 grants them persistent execution control over the account until the authorization is revoked.
Odaily Report: Derek Chiang, founder of ZeroDev and a developer involved with EIP-7702, posted on X stating that first, to be clear — EIP-7702 itself has no vulnerability. If you are using a wallet that supports EIP-7702 (MetaMask, Uniswap, Ambire, etc.), please do not panic.EIP-7702 is an Account Abstraction improvement proposal that allows externally owned accounts (EOAs) to sign a special message called a "7702 authorization," thereby embedding a smart contract into that account. This enables accounts to achieve powerful functionality, such as transaction batching — combining "authorization" and "transfer" into a single transaction, allowing you to complete a swap on Uniswap with just one click.Unfortunately, the same feature also allows hackers to efficiently transfer all your tokens in a single transaction. In the Binance hack incident, the hacker moved ETH, USDT, and 62 other tokens in one transaction, whereas without EIP-7702, they would have needed to send a separate transaction for each token. In this particular incident, many such transactions would have failed anyway, because Binance was still using the compromised wallet for withdrawals at the time, so all transactions sent by the hacker had to compete with legitimate transactions for Nonce (transaction sequence number). Therefore, using EIP-7702 did help the hacker steal funds as quickly and as extensively as possible.However, for the hacker to use EIP-7702, one of the following conditions must have been met: first, they obtained the private key; second, they tricked Binance into signing a 7702 authorization — the latter is highly unlikely, as it is hard to imagine Binance exposing an endpoint used for signing 7702 authorizations (or worse, signing raw messages that could be repackaged by the hacker for 7702 authorization). But until the official postmortem report is released, this possibility cannot be completely ruled out.Derek Chiang added: "As one of the contributors to account abstraction, I feel somewhat responsible for this hack incident, because while giving accounts more powerful functionality, we have indeed also given hackers stronger capabilities."
Odaily Report: During the Binance attack, an obvious arbitrage opportunity emerged on-chain. According to a community user's review, the attacker, in order to avoid Tether freezing, swapped a large amount of USDT for ETH through DEXs, causing the ETH price on Uniswap to briefly rise to $2,560–$2,750, with some individual trades exceeding $3,000, while Aave's ETH price obtained through the Chainlink oracle remained at $2,250–$2,290. A price gap of 15% to 30% appeared between on-chain and oracle prices, lasting nearly an hour.Arbitrageurs exploited this price gap by depositing USDC/USDT as collateral into Aave, borrowing ETH at the oracle price, then selling it at high prices on DEXs, and buying back ETH to repay the loans once the spread narrowed. According to the user's statistics, within 6 hours after the incident, a total of 61 addresses borrowed ETH on Aave mainnet (excluding the hacker's address). Among them, the most profitable address sold 12,289 ETH at an average price of approximately $2,580, then bought back 12,314 ETH at an average price of approximately $2,297, earning about $3.47 million. The top ten arbitrage addresses collectively profited approximately $6.36 million.The user stated that the arbitrageurs exploited the price disconnection between centralized exchanges and DEXs, and that the Aave contract itself had no vulnerability. As DEX prices fell back and Aave froze the mainnet V3 market, the arbitrage window gradually closed. The above profits are based on transaction-by-transaction on-chain statistics and have not yet deducted Gas fees.
Cobo co-founder Shenyu released a video analyzing the Binance theft from an on-chain transaction perspective. At 4:20 AM, the attacker broadcast a transaction containing 50 authorization requests signed with Binance's hot wallet private key, and began batch-transferring assets approximately three minutes later. Shenyu noted that the attack utilized the EIP-7702 authorization mechanism; the attacker had prepared a transfer list covering 64 tokens in advance and conducted two test runs using a test wallet, with the final run occurring roughly 3.5 hours before the main operation. The attacker subsequently transferred assets through multiple wallets and smart contract wallets, exchanging portions of stablecoins such as USDT for ETH to evade issuer-initiated freezes.
Odaily reports: Smart contract developer Justin Kalland posted on X that the Binance hacker appears to have made a potential mistake, and MetaMask should retain as much of any Web2 logs as they can obtain.Specifically, the hacker sent 175 million USDT to a new wallet, and about 2.5 minutes later, that wallet also received 2 ETH. This was likely used to pay for Gas fees, consistent with the pattern used by their other attack wallets.Exactly two minutes after that, the wallet used MetaMask's Gas Station service, even though it already had Gas fees at the time. Three consecutive transactions landed in the same block — an ETH top-up from Gas Station, an infinite USDT approval to the Kyber Network router, and a payment of 127.67 USDT to Gas Station. The amount of the ETH top-up exactly matched the combined maximum Gas budget of the Kyber approval and the USDT payment. Accurate down to wei (the smallest Ethereum unit).But the problem is that the ETH they had at the time was already fully sufficient to cover both fees, so a reasonable speculation is that they were using a MetaMask wallet at the time and, due to haste, mistakenly selected USDT to pay for Gas fees. For convenience, MetaMask sometimes defaults to this method, and the order of top-ups within the same block also matches how its implementation mechanism works.To use Gas Station in MetaMask, users must use MetaMask Sentinel. This means the transactions were broadcast through them, rather than through a regular RPC. This interaction likely left off-chain records at MetaMask, which may include IP metadata.Among all the attacker's wallets that have been checked, this is the only wallet showing use of Gas Station, and the wallet address is: 0xAa246BF639586a6Ba46762D378CE50cA4fc654a0.
Odaily Report: Marc Zeller, founder of the Aave Chan Initiative (ACI), posted on X stating that the Aave protocol is fine.The Binance hacker injected 60 million USDT into the protocol within just 3 minutes and borrowed 19,762 wETH (approximately $44.9 million), at which point Tether had not yet frozen the address, nor had the Aave Guardian frozen the Aave V3 Core pool's reserves (this operation occurred 46 minutes later).However, USDT is backed by real dollars, and from the protocol's perspective, although this position is the proceeds of crime, it is overcollateralized — with a health factor of 1.04, holding $59.9 million in collateral against $44.9 million in debt.Of course, the protocol now has a large borrower with little incentive to repay the loan, but the liquidation mechanism will still operate as usual. If the ETH price rises above approximately $2,365 (+4%), the position will be liquidated just like any other position.Currently, the Aave V3 Core pool's total wETH reserves stand at 2.16 million wETH, and the hacker's debt accounts for "only" 0.9% of that, so Aave does not need to take any special action against the hacker. There are currently 345,000 wETH available (capital utilization rate of 81.6%), so if wETH depositors wish to withdraw, liquidity is fully sufficient. There is no reason or need for a bank run to occur.This situation is far less alarming than the Kelp hacker incident (which involved zero-value collateral). In theory, a governance proposal could be passed to force liquidation of the hacker by upgrading the pool (if the USDT liquidation threshold were lowered, it would affect all USDT depositors), but there is no practical benefit to doing so, as the normal liquidation mechanism can easily absorb this debt.
Odaily report: A wallet suspected to be associated with the Binance hack incident received tens of thousands of ETH through a Uniswap contract and borrowed 19,762 ETH on Aave using approximately $60 million in USDT as collateral. On-chain records do not show any vulnerabilities in Uniswap or Aave.As of 22:07 UTC, the two wallets held approximately 253,000 ETH, worth about $570 million, with no outgoing transfers recorded. Aave has paused the Ethereum mainnet V3 market, and Kamino has also paused borrowing in the SOL/BTC market; Ripple has frozen approximately $200 million in RLUSD, and more than $2 billion in USDT and USDC has been frozen by stablecoin issuers. (Decrypt)
Odaily Report: According to monitoring by Bitcoin News, on-chain analysis shows that after attackers exploited a malicious EIP-7702 authorization to take control of a Binance wallet, the wallet's key remained usable. Binance reportedly used the signing key to execute transactions through the compromised wallet, recovering $823 million in USDC. The attackers reportedly obtained 50 valid authorizations signed by the wallet's key, one of which successfully activated malicious code and moved 65 types of assets. Even after Tether and Circle blacklisted the attackers' addresses, the asset transfers reportedly continued; a $200 million USDT deposit was moved out just 100 seconds after it arrived.
OKX founder Star praised Circle and Tether for their freezing actions in the suspected theft incident at Binance, calling on exchanges and stablecoin issuers to jointly establish an industry-wide real-time early warning and rapid freeze mechanism.
DefiLlama founder 0xngmi estimates that Binance's actual losses after USDT and USDC were frozen total approximately $1 billion; CZ responded that the losses may be slightly higher but will be fully covered. Around $27 million in related funds for USDT have also been frozen.
According to Lookonchain, the assets involved in the suspected Binance hack exceed $5.8 billion, with approximately 1.58 billion USDT and 823 million USDC (totaling roughly $2.41 billion) already frozen.
According to Whale Alert, within approximately 40 minutes of the suspected Binance hack, around $2.37 billion in USDT and USDC was frozen; addresses tagged as "Binance Hack 2026" additionally transferred out approximately 7.019 million UNI.
Odaily reports: On-chain monitoring shows that the total assets flowing out of Binance-labeled wallets amounted to approximately $5.643 billion. The breakdown includes: $3.528 billion on Ethereum, $1.449 billion on Bitcoin, $628 million on Tron, and $38 million combined across Arbitrum, Optimism, and Base networks. The tally excludes change outputs and avoids double-counting subsequent transfers and swaps. Tether and USDC issuer Circle have frozen at least $2.316 billion in stablecoins, including approximately $1.493 billion in USDT and $823 million in USDC.