$5.8B stolen from Binance, $2.435B stablecoins frozen as hacker dumps $PEPE, $LINK, $UNI, $ENA

Binance's Chinese official account stated that its team is continuously working closely with law enforcement agencies, asset issuers, blockchain intelligence firms and industry partners to track and freeze more relevant assets. The total frozen amount is expected to rise further, and updates will be shared in a timely manner once more confirmation is available.

Coinbase Chief Security Officer Jeff Lunglhofer said in a post that Coinbase’s security team is intercepting transfers to compromised Binance wallets, and has made partial adjustments to its cold wallet system solely out of prudence.

Lido released a statement noting it has been monitoring the suspected Binance wallet hack incident. stETH remains unaffected, and its staking protocol (including withdrawals) continues to operate normally. Lido Earn has no direct exposure to the incident, is monitoring the situation to manage risks, user deposits remain secure, and the platform will provide further updates as needed.

Xie Jiayin, head of Bitget's Greater China region, posted on social media that Bitget's team is ready to support Binance wherever needed, backing the relevant parties' proper freezing and tracking operations.

Regarding the Binance hack, some believe the attackers may have exploited Ethereum’s EIP-7702 mechanism to take control of wallets and siphon funds. X user 0xVEER noted that developer 0xjustadev warned against “this scenario” as early as during EIP-7702 discussions roughly two years ago. In October 2024, a developer in the Ethereum Community Forum’s EIP-7702 (Set EOA account code) discussion thread pointed out that current phishing attacks mostly rely on EIP-712 signatures, which are relatively readable and easy to spoof. The EIP-7702 proposal, however, could allow attackers to drain all valuable assets—including native tokens—via signatures that are less readable and harder to simulate. The developer also expressed concern that wallets might adopt highly centralized contract signature whitelists as a result, a step backward for security and decentralization. To date, Binance has not officially confirmed whether the incident is indeed linked to EIP-7702, and the above content is solely community perspectives.

Wintermute founder Evgeny Gaevoy stated in a post that Binance has sufficient capital to withstand 3 to 4 times the current impact and remain intact, is very likely to weather the crisis, and user funds are most probably safe. However, he advised against continuing to deposit funds with Binance until the issue is clarified. Gaevoy also noted that Wintermute does hold exposure to Binance, which accounts for less than 20% of its net assets, and under no scenario does he expect this to cause any operational disruption to Wintermute over any time period.