Hacked Event Broadcast

On October 31, 2026, the Bitcoin dual-staking protocol b14g suffered a security incident in which approximately 97 million CORE tokens staked through the protocol were withdrawn without authorization and transferred to attacker-controlled addresses. The team paused the affected contracts and is coordinating with the Core team, security partners, and exchanges to trace, freeze, and recover the funds. BTC staked via the protocol remained time-locked on Bitcoin and was unaffected.

Binance, the world’s largest cryptocurrency exchange, suffered a highly sophisticated attack on its hot wallets. Attackers gained unauthorized access to internal systems (via fake job interviews, malware, and compromised internal AI tools), obtained signing privileges, and used mechanisms like EIP-7702 to rapidly drain approximately $6.34 billion across multiple blockchains. About $2.85 billion has been frozen or intercepted; Binance pledged full coverage of losses (not borne by users) and has replenished ~98% of affected tokens. The FBI attributed the attack to North Korea-linked actors.

Polymarket’s international platform (Polymarket.com) suffered a security incident after a third-party provider (DebugBear, a website performance monitoring tool) was compromised. Malicious JavaScript drained funds from some users’ accounts (approximately $2.65–2.7 million). Trading was paused for about an hour, then resumed. Polymarket promised to fully reimburse all affected traders and referred the matter to UK law enforcement.

The zkLink Nova cross-chain bridge (Ethereum L1 escrow contracts) was exploited. The attacker abused a publicly callable authorized SyncL2TxHashRelayer and a flaw in the Arbitrator contract (failure to clear transient finalizeMessageHash), first populating a valid hash then reusing it to install an attacker-chosen l2LogsRootHashes root under the legitimate gateway identity, enabling withdrawals of ETH and ERC20 assets via forged proofs.

On October 29, 2026, multiple Binance hot wallets (notably Binance 14 on Ethereum) were drained of billions in assets within a short window. The attacker used EIP-7702 delegation to gain control and sweep funds across several chains, marking one of the largest exchange security incidents in crypto history. Binance suspended deposits/withdrawals, stated that user funds are safe and will cover all losses, while stablecoin issuers quickly froze significant amounts.

Hifi Finance suffered a DAO governance takeover. An attacker, using addresses funded via Tornado Cash, cast four last-minute votes to pass a malicious proposal (Proposal 21), gained control, upgraded the BalanceSheet contract, minted 25 million HIFI tokens, and drained approximately $1 million in user collateral (mostly RWA tokens).

A TranchePool on Avalanche associated with Valinor Digital, Oatfi, and Fence Finance was exploited due to a settlement logic flaw. At the UTC day rollover, a scheduled principal payment was incorrectly treated as received, artificially restoring ~$1.013M of draw capacity and allowing the attacker to draw the same amount of USDC a second time.

The Diamante ecosystem experienced a security breach involving unauthorized activity by a malicious actor. The team activated emergency protocols, coordinated with exchanges and liquidity providers to suspend affected withdrawals and transfers, identified the suspected attacker, is working with law enforcement across multiple countries for recovery, and pledged to make all affected participants whole.

The Diamante team discovered that the $DIAM contract on BSC was compromised. The attacker used stolen company access keys to take control of the contract and minted 161 million unauthorized DIAM tokens. Approximately 70% of the unauthorized tokens were subsequently frozen through cooperation with exchanges, the contract was secured under a new MPC wallet, and the team pledged to make all affected participants whole.

Predict.fun (a BNB Chain prediction market) saw approximately 397,708 USDT drained from 29 user smart wallets (Kernel/ZeroDev-based) in two waves on October 22 and 27, 2026. Each drain was signed with the compromised owner private key; no protocol contracts were exploited. The team attributes it to a compromised third-party API documentation site, took the site offline, and pledged full reimbursement to affected users, with a full post-mortem forthcoming.

The Diamante team discovered that the $DIAM contract on BSC was compromised. The attacker used stolen company access keys to take control of the contract and minted 161 million unauthorized DIAM tokens. Approximately 70% of the unauthorized tokens were subsequently frozen through cooperation with exchanges, the contract was secured under a new MPC wallet, and the team pledged to make all affected participants whole.

A 2-of-7 Safe multisig on Avalanche holding trading inventory had granted unlimited approvals to an address that anyone could deploy code to due to a misconfiguration. An attacker’s attempt was front-run by an MEV bot, which took approximately $7.45M in assets. The bot claims to be a whitehat and is negotiating the return of funds for a 5–10% bounty.

The cross-chain trading automation platform Bloom Trading suffered a security incident. Attackers exploited a Remote Code Execution (RCE) vulnerability in a third-party module, draining approximately 9,408 SOL (about $947,000) from 49 wallet addresses belonging to 9 users. The team confirmed no private keys were compromised, other wallets remain safe, pledged full reimbursement to affected users, and temporarily paused some services while investigating.

The Ethereum DeFi protocol Yapeswap (an AMM DEX) was hit by a governance attack. WorkersUnion’s zero-quorum setting allowed a proposal backed by only ~0.000055% of voting power to transfer YapeFactory’s feeToSetter role to the attacker. The attacker then installed a malicious Registry that made latestVault() return fake vaults while vaults() still listed real ones. YapePair counted the diverted deposits as farming assets without issuing redeemable shares, resulting in a loss of approximately $21,900.

X100, an Ethereum-based DeFi project, was exploited via a flash-loan governance attack on its three-seat Senate. The attacker borrowed ~$1.94M USDT from Aave, acquired and locked X tokens to seize two Senate seats by a tiny margin (~0.000001 X), then in the same transaction passed and executed a malicious proposal forcing the Freezer/Treasury to sell 400,000 X into an attacker-created thin pool for only ~$35.68. After repaying the loan and further extraction, ~$4.85M USDT was realized (main tx ~$4.75M), with additional X tokens taken.

Between October 24 and 26, 2026, an attacker exploited a bug in the XCM executor on Polkadot Asset Hub to reduce the recorded issuance of dotUSD without changing underlying account balances, breaking the assumption that recorded issuance equals the sum of all balances. This distorted pricing in the DOT/dotUSD pool and enabled arbitrage trades at an artificial rate. The Polkadot Treasury, as the sole liquidity provider, lost an estimated $1.381 million in DOT value. No user funds were lost. The vulnerability was reported via bug bounty and fixed in the codebase in June 2026 but was not deployed to the affected production runtime in time.

The Initia L1 and its Rollups were halted due to a security incident. An attacker exploited a zero-day (Day 0) bug in Initia's MoveVM implementation on the Cosmos SDK, allowing unlimited minting of unbacked tokens on the L1, and bridged out approximately $2.7 million worth of AUSD, ETH, and USDC before the chain was paused. Native INIT tokens were unaffected.

The Solana-based $kimchi token surged to a ~$14 million market cap after KOL @kimchi1x received 500M tokens and posted about it (with a repost by @a1lon9). The repost was later undone, the original post deleted, and the price crashed over 95%. On-chain analysis showed scammers used multiple wallets to buy low and sell high for over $385K in profit — a suspected coordinated KOL pump-and-dump rug pull.

The WAX Multi-Chain Bridge (spanning WAX, Solana, and Ethereum) was exploited due to a smart contract logic flaw. The eth.token::withdraw function failed to enforce max_fee ≥ 0 before debiting; the attacker set a negative max_fee equal to -quantity, zeroing the debit while still generating a full withdrawal log and bridge records. This triggered corresponding asset releases on Solana and Ethereum, resulting in a loss of approximately $90,500. Officials confirmed the issue was limited to a bridge contract (stablecoins affected; WAXP and the main chain unaffected) and paused bridge processing.

The NEM (NemTokenV2) token contract on BSC was exploited via its PancakeSwap USDT/NEM liquidity pool. The contract credited transfers into the LP as sell volume without verifying actual swap settlement. The attacker repeated transfer → skim() → flushLpSellRecycle() 42 times, burning pre-existing LP reserves and syncing lower reserves, then sold the remaining NEM at the inflated price to extract approximately $821,920 in USDT.