Onchain Security Roundup: Oct 26 - Nov 2

Binance Hot Wallets Drained Across 10 Chains

TL;DR: On October 29th an attacker stole funds from several hot wallets at Binance, the largest centralized exchange, across 10 chains. Binance estimates the affected amount at $6.3 billion, the largest heist on record. On Ethereum the attacker used an EIP-7702 delegation to turn a Binance wallet into a sweeper; on the other chains the wallets signed ordinary transfers. Binance says partners froze $3 billion, that it will cover all losses, and reopened withdrawals.

The outflows began at 20:05 UTC on the XRP Ledger and reached Solana, Bitcoin, Ethereum, TRON, Arbitrum, Optimism, Base, and Avalanche within half an hour. A second wave near 23:05 UTC hit Avalanche again and added Polygon. Binance estimates the affected amount at $6.3 billion; our incident report gives a verified chain-by-chain accounting of the loss. The Ethereum leg is visible in one transaction: at 20:24 UTC the wallet known as Binance 14 called a sweep function that sent 1,615,409,498 USDT to a fresh address, followed 24 seconds later by 55,739,800 USDT from a second Binance wallet, and 823,000,000 USDC arrived at the same attacker address over the next 35 minutes.

The Ethereum mechanism was a delegation under EIP-7702, which lets an externally owned account carry contract code. Blockaid found that the attacker did not know Binance 14's live nonce and so packed 50 pre-signed authorizations covering a range of nonces into a single type-4 transaction, only one of which matched. On the other nine chains, and from the second Ethereum wallet, the funds left with ordinary valid signatures. Binance said its preliminary investigation points to a compromised DevOps engineer's laptop that gave access to an internal service container and allowed unauthorized withdrawal submissions, that it found no evidence of a private-key leak, and that it has identified additional points of breach.

Tether began freezing at 21:01 UTC and Circle three minutes later. TRM Labs counts $2.7 billion frozen across Tether, Circle, Ripple, World Liberty Financial, and Arbitrum's Security Council, which froze 8,426 ETH and 74.6 million ARB; Binance says partners have frozen $3 billion. The attacker raced those freezes by selling USDT to market makers and borrowing ETH on Aave v3 against stolen stablecoin collateral, which prompted Aave's guardians to freeze reserves across its V3 markets and all 18 Aave V4 spokes between 21:42 and 23:04 UTC before reopening them. 

TRM Labs says the attacker now holds more than 420,000 ETH and 18,270 BTC that no issuer can freeze, and TRM Labs, Elliptic, Chainalysis, and the FBI attribute the attack to North Korea's TraderTraitor group. Binance pledged to cover all losses from its SAFU reserve and company funds, says it has so far covered 95% of the stolen assets, and reopened withdrawals at 06:00 UTC on November 1st.

Polymarket Front End Hijacked Through a Third-Party Script

TL;DR: On October 29th malicious code served in place of DebugBear's performance-monitoring script on Polymarket, the prediction market, used signed-in traders' own sessions to sell or transfer their positions. Polymarket says it is refunding $2.7 million to 726 affected wallets, and Ohey's trace shows 28.6 million POL, valued at $2.64 million, reaching one attacker wallet in under an hour. DebugBear says its DNS was hijacked at its domain registrar.

DebugBear is a page-performance vendor whose monitoring script Polymarket loaded from DebugBear's domain. When attackers compromised DebugBear's DNS records at its domain registrar, Polymarket's pages fetched a malicious file in its place; DebugBear said the attack appears to have targeted one customer's copy of the script. Researchers at Ohey saw a different server answering for DebugBear's addresses at 18:13 UTC while the malicious file was still online, and Hudson Rock downloaded the file from the address Polymarket's site used to load it. Hudson Rock's static review found no code that exfiltrated API keys, passwords, seed phrases, or private keys. Instead the script located the order component and the session signer on the open page and asked the trader's own signer to approve requests, which Polymarket's relayer then submitted like any legitimate order.

The code followed two paths. For accounts that sign in with their own wallet, it moved positions straight to the attacker. For accounts that sign in by email, it sold positions at progressively worse prices and withdrew the proceeds. Ohey's trace shows the attacker wallet receiving its first funds at 17:10 UTC and its last at 18:02 UTC, then forwarding 28.6 million POL to three addresses between 18:28 and 18:38 UTC. Polymarket posted its first notice at 17:38 UTC and put the exchange into cancel-only mode at 18:05 UTC. The reporting does not establish how many signatures completed without a visible prompt, and Ohey's count of 33 source wallets is not reconciled with Polymarket's count of 726 affected wallets.

Polymarket said it removed the script within the hour, cleared every cache, reset all sessions, paused trading, and referred the case to law enforcement. By October 30th it had refunded 689 of the 726 wallets in full and was paying the rest as they were checked, plus $1.19 million to 5,500 wallets hurt by the trading pause, $3.9 million in all. It says third-party scripts are being restored behind a stronger content security policy with pinned versions and sandboxing, and DebugBear has told its monitoring customers to remove its embed code.

b14g Zero-Amount Withdrawals Release 97 Million CORE

TL;DR: On October 31st an attacker drained 97 million CORE, valued by Bitquery at $1.47 million, from 91 staking positions at b14g, a BTC staking platform on the Core chain, in a single transaction by submitting withdrawal requests for zero tokens. Core's staking contract treats a zero amount as a full withdrawal, and b14g's contract forwarded the requests without checking ownership. b14g says BTC staked through it was unaffected and that exchanges froze 9 million CORE.

b14g lets BTC holders pair time-locked BTC with CORE deposits to earn higher staking rewards, and it manages those pairings through staking positions that delegate CORE to Core validators. According to Bitquery, at 09:29 UTC on October 31st the attacker submitted 99 withdrawal requests for zero CORE against 91 positions it had not funded. Rather than rejecting them, b14g's contract passed the requests to Core's staking contract, which interprets a zero-amount request as an instruction to withdraw the full balance. The contract released 97 million CORE to the attacker in one transaction. Bitquery said the attacker needed no administrator key and deployed no new contract, and that the vulnerable logic had been in place for 17 months, though it had not reviewed b14g's source and could not name the exact programming error.

Chain records cited by Bitquery show b14g did not pause the affected contracts until 10:35 UTC, 66 minutes after the attack, during which the attacker moved 23 million CORE through newly created addresses, some of it toward intermediaries linked to Bybit, Gate.io, and MEXC deposit addresses. Bitquery found that by the evening of October 31st 68 million CORE, 70% of the haul, sat unmoved in three wallets. b14g reported that exchange partners had frozen 9 million CORE linked to the attacker and said the breach was limited to CORE deposits because BTC staked through the platform stays time-locked on the Bitcoin network.

Core DAO said the chain's consensus, validators, and staking contracts were not compromised and that CORE staked directly with validators or through other protocols was unaffected. b14g has promised a postmortem covering the technical cause, user losses, and next steps for depositors, and has not yet announced a compensation plan.

TranchePool Settlement Bug Exploited at the UTC Day Rollover

TL;DR: On October 28th an attacker withdrew 1,013,353 USDC from a TranchePool lending vault on Avalanche associated with Valinor, Oatfi, and Fence Finance. A flash-loaned deposit made four minutes earlier was credited again as scheduled principal when the day rolled over, so it could be withdrawn twice. The contract was unverified, and the funds went to Solana through CCTP.

The pool is a tranched USDC lending vault on Avalanche. At 23:56 UTC on October 27th the attacker took a flash loan from Aave V3, deposited 1,013,353.61 USDC into the pool, and withdrew the same amount in the same transaction, leaving the pool's balance unchanged. Three seconds after midnight on October 28th a second transaction withdrew another 1,013,353.611686 USDC, and no USDC has moved out of the pool since because nothing was left. Both transactions succeeded onchain, and the amounts match Blockaid's and SlowMist's figures of $1.01 million.

SlowMist's reading, which Panda Security's transaction trace supports, is that the pool's settlement logic ran at the UTC day rollover and credited scheduled principal to the attacker's position without checking that the principal had actually arrived. The first transaction created the scheduled entry; the rollover honored it; the second transaction cashed it out. Defimon described the same flaw as a logic bug in an unverified contract, and the pool's source was not published on the explorer, so the analysis rests on observed behavior rather than code review.

Panda Security traced the proceeds through two Circle CCTP burns to Solana at 00:03 and 00:05 UTC, six minutes after the drain. Blockaid flagged the exploit as ongoing at 01:07 UTC. No statement from Valinor, Oatfi, or Fence Finance was available at the time of this report.

zkLink Nova Bridge Forged a Batch Root Through Transient Storage

TL;DR: On October 28th a single transaction pulled 11 tokens and 22.43 ETH from the Ethereum bridge of zkLink Nova, a Layer 3 rollup, led by 245.74 pufETH, for a total loss of $783,000. The bridge's claimMessage function left a transient-storage verification hash in place after use, so a second claim in the same transaction passed with a stale value and injected a forged batch root.

The attacker prepared at 16:01 UTC with a 1 USDC deposit into the bridge, which produced a genuine cross-chain message to work with. Six hours later the exploit transaction called claimMessage once legitimately and then, through an attacker-controlled external call, called it again before the first call's verification state had been cleared. The Arbitrator contract stores that verification hash in transient storage under EIP-1153, which lives only for the duration of a transaction, and it neither cleared the slot nor required a fresh authenticated callback for the second claim. The stale hash satisfied the check, and the attacker used the public SyncL2TxHashRelayer to submit a batch root of its own making.

Withdrawals against the forged root then finalized on Ethereum. The L1ERC20Bridge sent 245.74 pufETH, 12.57 ezETH, 18,113 USDC, 6.87 rsETH, 6.30 STONE, 0.1736 WBTC, 3,360 USDT, 2.48 mswETH, 2.64 mstETH, 0.466 wstETH, and 0.5 rswETH to the attacker's address in one transaction at 22:21 UTC. The same transaction withdrew 22.43 ETH from the bridge's ETH escrow. Three minutes later the attacker redeemed 132 pufETH for 141.95 WETH. A second address drained 33 smaller token balances from the bridge at 01:43 UTC on October 29th, led by 216.4 million ZKL worth $42,000, and Parapet Labs attributes a further wave against zkLink escrows on Optimism, Base, Blast, and Mantle to a different actor. SlowMist put the first transaction's loss at $783,100, BlockSec at $780,000, Blockaid at $786,000, and Defimon at $805,000.

SlowMist, BlockSec, Blockaid, and Defimon published consistent readings of the flaw, and Defimon noted that it had flagged the attacker's test harness before the exploit. zkLink Nova was reported halted as of October 31st. No postmortem from zkLink was available at the time of this report.

Troves Vault Drained Through a Retired Rebalancer on Starknet

TL;DR: On October 31st an attacker removed what Troves, a Starknet yield platform, puts at 8.57 WBTC-equivalent from its Ekubo xWBTC/WBTC vault, with an estimated value of $660,000. Troves says a legacy rebalancing contract kept its permissions over the vault after it was replaced. The protocol revoked the permissions, paused exposed vaults, and offered a 1 WBTC whitehat bounty open until November 3rd.

Troves, formerly STRKFarm, packages multi-step yield strategies into vaults on Starknet. The affected product supplied concentrated liquidity to the Ekubo xWBTC/WBTC pool, where xWBTC is Endur's liquid-staked BTC token, and it depended on a privileged rebalancing contract to keep the position in range. Troves says that when it shipped a new rebalancer the old one was never stripped of its permissions, and the attacker drove the vault through that retired contract.

The exploit transaction succeeded in block 17,220,375 and is accepted on Ethereum L1. Its token transfers show a helper contract borrowing 10 WBTC from a flash-loan provider, routing it through Ekubo and the vault, which deposited 9.43 WBTC and withdrew 9.38 WBTC in the process, repaying the 10 WBTC, and sending 6.32 WBTC to the attacker's account. Troves' onchain message to the attacker, relayed by Defimon, puts the total removed from the vault at 8.57 WBTC-equivalent, and its first public update said 8.6 BTC; the gap between that figure and the 6.32 WBTC observed leaving the attack contract was not reconciled for this roundup and may sit in residual balances or vault accounting. The block timestamp places the transaction at 08:25 UTC.

Troves revoked the legacy contract's permissions, paused the affected vault and others it considered potentially exposed, and said no other vault lost funds. Its bounty offer of 1 WBTC runs until 23:59 UTC on November 3rd.

Premia Vaults Drained via Empty Option Pools on Arbitrum

TL;DR: On November 1st an attacker drained six option vaults at Premia, an options protocol on Arbitrum, in two transactions. The six vaults lost $437,000 at the time of the attack. The attacker created empty option pools, used flash loans to buy options that locked the vaults' collateral into those pools, then withdrew the collateral as liquidity and swapped it to BTC via Chainflip and NEAR Intents.

Premia's vaults underwrite options: when a trader buys an option, the vault locks collateral in the relevant pool for the life of the contract. The attacker's address was newly funded and had made only three transactions when the exploit ran. A setup transaction at 03:14 UTC created option pools that contained nothing but the attacker's own parameters. The two drain transactions that followed took flash loans, bought options from the WBTC, WETH, and ARB call and put vaults so that each vault locked collateral into the attacker's pools, and then withdrew that collateral from the pools as if it were ordinary liquidity. Both drain transactions succeeded onchain.

The first transaction drained 3.64 WBTC, 43.47 WETH, and 21,334 USDC.e from the WBTC call, WETH call, and WETH put vaults and sent 43.24 ETH to the attacker. The second drained 46,215 ARB and 27,146 USDC.e from the ARB call, ARB put, and WBTC put vaults, converted the proceeds through Uniswap and Balancer pools, and unwrapped a further 148.54 ETH, 191.78 ETH in all. Blockaid flagged the exploit as ongoing at 04:13 UTC with $400,500 taken so far, and PeckShield's later tally of $464,600 covers both transactions and the bridge to Ethereum, where the funds were swapped into BTC through Chainflip and NEAR Intents.

Blockaid and Panda Security agree on the mechanism, and the attacker's own address has already attracted address-poisoning spam tokens, which is one reason the real flows are easier to read on the attack contract. No postmortem or statement from Premia was available at the time of this report.

Predict.fun Users Hit by Unauthorized Transfers

TL;DR: On October 27th Predict.fun, a prediction market on BNB Chain, said a small number of users saw unauthorized transfers totaling a reported 400,000 USDT and that its preliminary investigation points to a possible compromise of an API documentation site hosted by a third party. The site was taken offline. Predict.fun promised full reimbursement and a postmortem but has not explained how a documentation page led to transfers from user wallets.

Predict.fun's statement at 14:33 UTC on October 27th confirmed the transfers, the reported total, and the suspected source, and said the third-party documentation site would stay offline until the investigation finished. The provider was not named, no transaction hashes or addresses were published, and nothing about the incident could be verified onchain for this roundup.

Accounts on X have described earlier waves of transfers going back to mid-October. Predict.fun has not confirmed those claims, and they should be treated as unconfirmed until the postmortem appears. The suspected vector, a compromised documentation portal with some path to user transfers, is unusual enough to keep an eye on. What that path was, whether it involved API keys, embedded scripts, or something else, is the open question the postmortem needs to answer.

Predict.fun said affected users would be reimbursed in full for direct losses, without giving a payout date or a claims process.

Name.com DNS Hijack Serves a Drainer on 12 DeFi Sites

TL;DR: In the early hours of October 31st the domains of at least 12 DeFi projects, all registered with the domain registrar Name.com, were redirected to pages serving the Step Drainer kit. Bitquery counts $202,386 taken from 32 wallets across six chains, $160,531 of it from a single Kintsu staker on Monad; Blockaid's earlier count was $138,000. The drainer was still pulling approved tokens from victims on November 2nd.

Blockaid's first community alert at 02:21 UTC named flap.sh, kintsu.xyz, and stonkbrokers.cash, and by 03:16 UTC it had added StonkFun, Pickle Finance, Echelon, Origami Finance, FluxBeam, StakePoint, SupSwap, Longbow, Shprd Finance, and APEX. Bitquery places the campaign between 01:00 and 05:33 UTC and characterizes it as a registrar-level compromise as the affected domains were from Name.com. Name.com has since confirmed that attackers redirected 15 customer domains, put 10 of them on hold on October 31st, restored them, and told customers to review their DNS records and turn on two-factor authentication. Vercel said 10 of the hijacked domains were hosted on its platform. Name.com has not said how the records were changed.

The onchain pattern is visible on Monad and Ethereum. Between 01:56 and 05:55 UTC a drainer wallet on Monad received staked and interest-bearing MON positions from 34 victims through 34 redeemDelegations transfers, meaning the fake front ends asked visitors to sign delegations that the drainer then redeemed. On Ethereum a collector contract pulled approved tokens from victims and split each haul 55%, 30%, and 15% across three wallets, the structure Bitquery describes, with a split transaction at 01:25 UTC during the hijack window. The largest single loss came from one Kintsu staker whose 2,635,884 sMON reached the drainer wallet at 01:56 UTC; Bitquery values it at $160,531 and says the position went into the unstaking queue.

The same Ethereum collector was deployed on September 20th and ran batch pulls on October 23rd, 26th, and 27th, so the hijack reused an existing operation rather than starting one. And at 03:58 UTC on November 2nd the collector was still pulling AAVE tokens from a victim through transferFrom, 0.01 AAVE in dust-sized pulls, two days after the domains were recovered, so anyone who signed on the hijacked sites remains exposed until their approvals are revoked.