English
Blockaid
Report

Blockaid✓

@blockaid_

Trusted by Coinbase, MetaMask, Stellar, and more to detect, understand, and protect against fraud, scams, and exploits in real time.

448 Following25.7K Followers1.9K Posts
  1. Blockaid✓@blockaid_
    Blockaid has partnered with @LayerZero_Core to bring real-time threat intelligence verification to its cross-chain messaging. Bridge Sentinel is a Blockaid-operated DVN available to issuers on LayerZero. It screens every message against Blockaid's fraud detection engine for forged source events, malicious counterparties, and stolen funds before the DVN signs and assets move cross-chain. Learn more:
    Download
    564434.7K
  2. Blockaid✓@blockaid_
    The biggest theft in crypto history: an attacker used a stolen key to drain $5.5B from Binance’s hot wallets. Using advanced AI models and our industry-leading exploit detection engine, Blockaid detected it in under two minutes. Read more:
    Download
    718706K
  3. Blockaid✓@blockaid_
    Blockaid
    RT @idobn: Using advanced AI models @blockaid_ detected what is likely the biggest hack in the history of the world.
    Blockaid @blockaid_
    We are investigating a cluster of large outflows from Binance hot wallets that began at approximately 20:24 UTC on 29 October 2026. On-chain, the transfers look consistent with unauthorized movement from those wallets, but this has not been confirmed by Binance, and we cannot yet rule out an internal treasury or operational sweep. Observed chains: Ethereum, Arbitrum, and Avalanche, with related receipts also visible on Optimism. Observed scale (approximate, still being reconciled): Ethereum: about $2.5 billion from Binance 14 and Binance 16, plus an additional 780,000,000 USDC from a Binance smart account Arbitrum: about 8,426 ETH (~$19.5 million) Avalanche: about 1.81 million AVAX and 8.4 million USDT (~$24 million) Affected Binance wallets include: Ethereum Binance 14: 0x28C6c06298d514Db089934071355E5743bf21d60 Ethereum Binance 16: 0xDFd5293D8e347dFe59E90eFd55b2956a1343963d Ethereum smart account: 0xEe7aE85f2Fe2239E27D9c1E23fFFe168D63b4055 Arbitrum Binance 56 / Hot Wallet 1 / Binance 89: 0x1b5b4e441f5a22bfd91b7772c780463f66a74b35, 0xf92402bb795fd7cd08fb83839689db79099c8c9c, 0x3931dab967c3e2dbb492fe12460a66d0fe4cc857 Avalanche Binance 49 / 85 / 110 / 118: 0x9f8c163cBA728e99993ABe7495F06c0A3c8Ac8b9, 0x6D8bE5cdf0d7DEE1f04E25FD70B001AE3B907824, 0xABa2D404C5C41da5964453A368aFF2604Ae80A14, 0x3BCE63C6C9ABf7A47f52c9A3a7950867700B0158 Primary collection address (same across the affected chains): 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c Further destination wallets currently holding a large share of the funds include: 0x9749292D74Fd460982d0912eA9515EA24736C762, 0x0Ddf0480016e6bCb2C1F5d190D221FBA1320697e, 0x8532fa14acaf483729c449b8458aeddb900543d4, and 0x8d53903625b8e839b9DF4bd28B0EFb1CD6b8639A. We recommend treating this as unconfirmed until Binance issues an official statement. We will update as we verify more.
    070624
  4. Blockaid✓@blockaid_
    The attacker didn't know Binance 14's live nonce. So they sprayed 50 EIP-7702 auths (18914775-18914824) in one type-4 tx. Only 1 of 50 was a hit. A 7702 auth is valid only for the current nonce at inclusion. The hot wallet was still firing. One nonce in that window landed.
    Download
    40109641181K
  5. Blockaid✓@blockaid_
    This EOA was 7702-upgraded to an unverified sweeper contract. Impl: 0x63e842b054bd624a465454d533c33f573e9c6fae Only hardcoded operator 0x7c8601d4645b93cea45f71e118a729332e6b5ca0 can drain it. sweep() pulls every ERC-20 + ETH (leaves 1 ETH for gas). Incoming funds stay stealable.
    Download
    Blockaid @blockaid_
    We are investigating a cluster of large outflows from Binance hot wallets that began at approximately 20:24 UTC on 29 October 2026. On-chain, the transfers look consistent with unauthorized movement from those wallets, but this has not been confirmed by Binance, and we cannot yet rule out an internal treasury or operational sweep. Observed chains: Ethereum, Arbitrum, and Avalanche, with related receipts also visible on Optimism. Observed scale (approximate, still being reconciled): Ethereum: about $2.5 billion from Binance 14 and Binance 16, plus an additional 780,000,000 USDC from a Binance smart account Arbitrum: about 8,426 ETH (~$19.5 million) Avalanche: about 1.81 million AVAX and 8.4 million USDT (~$24 million) Affected Binance wallets include: Ethereum Binance 14: 0x28C6c06298d514Db089934071355E5743bf21d60 Ethereum Binance 16: 0xDFd5293D8e347dFe59E90eFd55b2956a1343963d Ethereum smart account: 0xEe7aE85f2Fe2239E27D9c1E23fFFe168D63b4055 Arbitrum Binance 56 / Hot Wallet 1 / Binance 89: 0x1b5b4e441f5a22bfd91b7772c780463f66a74b35, 0xf92402bb795fd7cd08fb83839689db79099c8c9c, 0x3931dab967c3e2dbb492fe12460a66d0fe4cc857 Avalanche Binance 49 / 85 / 110 / 118: 0x9f8c163cBA728e99993ABe7495F06c0A3c8Ac8b9, 0x6D8bE5cdf0d7DEE1f04E25FD70B001AE3B907824, 0xABa2D404C5C41da5964453A368aFF2604Ae80A14, 0x3BCE63C6C9ABf7A47f52c9A3a7950867700B0158 Primary collection address (same across the affected chains): 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c Further destination wallets currently holding a large share of the funds include: 0x9749292D74Fd460982d0912eA9515EA24736C762, 0x0Ddf0480016e6bCb2C1F5d190D221FBA1320697e, 0x8532fa14acaf483729c449b8458aeddb900543d4, and 0x8d53903625b8e839b9DF4bd28B0EFb1CD6b8639A. We recommend treating this as unconfirmed until Binance issues an official statement. We will update as we verify more.
    21311393.4K
  6. Blockaid✓@blockaid_
    Blockaid
    RT @blockaid_: We are investigating a cluster of large outflows from Binance hot wallets that began at approximately 20:24 UTC on 29 October 2026. On-chain, the transfers look consistent with unauthorized movement from those wallets, but this has not been confirmed by Binance, and we cannot yet rule out an internal treasury or operational sweep. Observed chains: Ethereum, Arbitrum, and Avalanche, with related receipts also visible on Optimism. Observed scale (approximate, still being reconciled): Ethereum: about $2.5 billion from Binance 14 and Binance 16, plus an additional 780,000,000 USDC from a Binance smart account Arbitrum: about 8,426 ETH (~$19.5 million) Avalanche: about 1.81 million AVAX and 8.4 million USDT (~$24 million) Affected Binance wallets include: Ethereum Binance 14: 0x28C6c06298d514Db089934071355E5743bf21d60 Ethereum Binance 16: 0xDFd5293D8e347dFe59E90eFd55b2956a1343963d Ethereum smart account: 0xEe7aE85f2Fe2239E27D9c1E23fFFe168D63b4055 Arbitrum Binance 56 / Hot Wallet 1 / Binance 89: 0x1b5b4e441f5a22bfd91b7772c780463f66a74b35, 0xf92402bb795fd7cd08fb83839689db79099c8c9c, 0x3931dab967c3e2dbb492fe12460a66d0fe4cc857 Avalanche Binance 49 / 85 / 110 / 118: 0x9f8c163cBA728e99993ABe7495F06c0A3c8Ac8b9, 0x6D8bE5cdf0d7DEE1f04E25FD70B001AE3B907824, 0xABa2D404C5C41da5964453A368aFF2604Ae80A14, 0x3BCE63C6C9ABf7A47f52c9A3a7950867700B0158 Primary collection address (same across the affected chains): 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c Further destination wallets currently holding a large share of the funds include: 0x9749292D74Fd460982d0912eA9515EA24736C762, 0x0Ddf0480016e6bCb2C1F5d190D221FBA1320697e, 0x8532fa14acaf483729c449b8458aeddb900543d4, and 0x8d53903625b8e839b9DF4bd28B0EFb1CD6b8639A. We recommend treating this as unconfirmed until Binance issues an official statement. We will update as we verify more.
    030031.1K
  7. Blockaid✓@blockaid_
    Blockaid is attending @efdevcon: Devcon brings together the developers behind @ethereum, and more of what they ship now moves money at institutional scale. We are the money security company, helping keep that value safe. We look forward to meeting with everyone there.
    Download
    2091.8K
  8. Blockaid✓@blockaid_
    Blockaid has partnered with @project0 to bring onchain monitoring to its DeFi prime brokerage. Onchain Monitoring covers its program and venue positions, catching upstream risk in real time for the trading firms and institutions it serves. Learn more:
    Download
    23193.2K
  9. Blockaid✓@blockaid_
    🚨Blockaid detected an ongoing exploit on @zkLink_Official bridge on ethereum. Used a public relayer to inject a forged batch root on Ethereum, then finalized ETH and ERC20 withdrawals from zkLink Nova L1 escrow to attacker-chosen receivers. ~$786k drained from L1 ETH escrow and ERC20 bridge so far. Attack still ongoing.🧵
    221510316.4K
  10. Blockaid✓@blockaid_
    Posts @blockaid_
    Exploiter addresses: Example exploit tx: Victim contract: Victim bridge:
    0042K
  11. Blockaid✓@blockaid_
    🚨Blockaid detected an ongoing exploit on Tranche Vault related to @fence_finance and @valinordigital on Avalanche. An attacker used a flash loan to mint inflated tranche shares, then redeemed the vault's remaining USDC. ~$1.01M drained from the vault so far across ~2 txs. 🧵
    17149214.3K
  13. Blockaid✓@blockaid_
    Congratulations to @0xPredicate on the Series A. Enforcing compliance at the transaction level is the way regulated markets should operate onchain, and Blockaid is proud to partner with the team.
    Predicate @0xPredicate
    We are thrilled to announce our $8M Series A to connect regulated markets to onchain finance. Predicate enables digital assets to reach every market compliantly. We do this by embedding compliance controls directly into digital assets to block high-risk and sanctioned activity at every transaction. To date, Predicate has: - Screened $1B+ in transaction volume - Evaluated 6M+ transactions against custom compliance policies - Blocked 100K+ non-compliant transactions The round was led by @bcap with participation from @Paxos, @1kxnetwork and @tribecap.
    40153.7K
  14. Predicate✓@0xPredicate
    We are thrilled to announce our $8M Series A to connect regulated markets to onchain finance. Predicate enables digital assets to reach every market compliantly. We do this by embedding compliance controls directly into digital assets to block high-risk and sanctioned activity at every transaction. To date, Predicate has: - Screened $1B+ in transaction volume - Evaluated 6M+ transactions against custom compliance policies - Blocked 100K+ non-compliant transactions The round was led by @bcap with participation from @Paxos, @1kxnetwork and @tribecap.
    Download
    1215647766.5K
  15. Blockaid✓@blockaid_
    Posts @blockaid_
    Blockaid's Risk Exposure API feeds real-time data on stolen funds and exploit-related addresses into Predicate's compliance policies, so those policies can act on risk the moment it's flagged.
    Blockaid @blockaid_
    Blockaid partners with @0xPredicate on real-time compliance. With Predicate enforcing compliance policies, Blockaid's Risk Exposure API now feeds in real-time data on stolen funds and exploit-related addresses, so policies can catch risk the moment it's flagged. Read more:
    0021.2K
  16. Blockaid✓@blockaid_
    Blockaid partners with @0xPredicate on real-time compliance. With Predicate enforcing compliance policies, Blockaid's Risk Exposure API now feeds in real-time data on stolen funds and exploit-related addresses, so policies can catch risk the moment it's flagged. Read more:
    Download
    021210.6K
  17. Blockaid✓@blockaid_
    🚨 Blockaid detected an ongoing exploit on X100 on Ethereum. An attacker seized two of three Senate seats and sold 400,000 X from the treasury into an empty pool they created. A second attacker later burned the Freezer’s Uniswap V3 positions. ~$4.85M USDT realized so far across 2 txs. Attack still ongoing.
    352714919.2K
  18. Blockaid✓@blockaid_
    Posts @blockaid_
    Update: a third attacker used the same Senate path and pulled the remaining ~550,000 X Uniswap V3 LP. ~$4.85M USDT realized plus ~550k X extracted across 3 txs. ~12.2M X still in the Freezer. Attack still ongoing.
    1151.8K
  19. Blockaid✓@blockaid_
    Posts @blockaid_
    Third exploit tx: Exploiter: Loot:
    0121.4K
  20. Blockaid✓@blockaid_
    Posts @blockaid_
    Exploiter addresses: Example exploit tx: Victim / abused token:
    1013.2K
  21. Blockaid✓@blockaid_
    Traditional finance and payment institutions are rapidly adopting onchain technology, and @money2020 Las Vegas showcased that momentum. Stablecoins, tokenized assets, and agentic payments are creating new ways to move money, and the security underneath has to evolve with them. We are the Money Security Company, and the team that can help these new use cases scale safely. Blockaid met with customers and prospects, learned what the industry needs, and showed why new financial rails need new risk infrastructure. We look forward to working with everyone building on these rails. It was a proud week for the team that put this together, and for everyone behind the scenes bringing security onchain.
    Download
    1013.5K
  22. Blockaid✓@blockaid_
    In 2026 so far, $1.18B has been stolen across 60 major onchain exploits. Less than 1% of the funds (just $9.8M) has made it back to those who lost it. Since our H1 report, Blockaid has followed that money to see where it ended up and how much of it could have been frozen. Today we’re publishing Blockaid’s 2026 Fund Recovery Threat Landscape, tracing each stolen asset to where it sits today, covering attacker speed, exit routes, freeze channels, and fund recovery mechanisms.
    Download
    42154.4K
  23. Blockaid✓@blockaid_
    Posts @blockaid_
    The findings that stood out most: - Stolen funds typically moved within 17 minutes of the exploit - In 68% of incidents, funds were moving within the first hour - Every recovery relied on a freeze mechanism already in place - Issuer blacklists and exchange freezes returned $0 - Only 5 of 60 incidents saw any funds recovered or frozen
    Download
    1032.3K
  24. Blockaid✓@blockaid_
    Posts @blockaid_
    Get the full report here:
    Download
    001294