In addition to our earlier alert, the same attack has now been identified on additional sites. These are actively serving the Step Drainer: • stonkfun[.]xyz • pickle[.]finance • echelon[.]market • origami[.]finance • fluxbeam[.]xyz • stakepoint[.]app • supswap[.]xyz • longbow[.]cash • shprd[.]finance • apexdefi[.]xyz We’re actively investigating and gathering more data.

The attacker didn't know Binance 14's live nonce. So they sprayed 50 EIP-7702 auths (18914775-18914824) in one type-4 tx. Only 1 of 50 was a hit. A 7702 auth is valid only for the current nonce at inclusion. The hot wallet was still firing. One nonce in that window landed.

We are investigating a cluster of large outflows from Binance hot wallets that began at approximately 20:24 UTC on 29 October 2026. On-chain, the transfers look consistent with unauthorized movement from those wallets, but this has not been confirmed by Binance, and we cannot yet rule out an internal treasury or operational sweep. Observed chains: Ethereum, Arbitrum, and Avalanche, with related receipts also visible on Optimism. Observed scale (approximate, still being reconciled): Ethereum: about $2.5 billion from Binance 14 and Binance 16, plus an additional 780,000,000 USDC from a Binance smart account Arbitrum: about 8,426 ETH (~$19.5 million) Avalanche: about 1.81 million AVAX and 8.4 million USDT (~$24 million) Affected Binance wallets include: Ethereum Binance 14: 0x28C6c06298d514Db089934071355E5743bf21d60 Ethereum Binance 16: 0xDFd5293D8e347dFe59E90eFd55b2956a1343963d Ethereum smart account: 0xEe7aE85f2Fe2239E27D9c1E23fFFe168D63b4055 Arbitrum Binance 56 / Hot Wallet 1 / Binance 89: 0x1b5b4e441f5a22bfd91b7772c780463f66a74b35, 0xf92402bb795fd7cd08fb83839689db79099c8c9c, 0x3931dab967c3e2dbb492fe12460a66d0fe4cc857 Avalanche Binance 49 / 85 / 110 / 118: 0x9f8c163cBA728e99993ABe7495F06c0A3c8Ac8b9, 0x6D8bE5cdf0d7DEE1f04E25FD70B001AE3B907824, 0xABa2D404C5C41da5964453A368aFF2604Ae80A14, 0x3BCE63C6C9ABf7A47f52c9A3a7950867700B0158 Primary collection address (same across the affected chains): 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c Further destination wallets currently holding a large share of the funds include: 0x9749292D74Fd460982d0912eA9515EA24736C762, 0x0Ddf0480016e6bCb2C1F5d190D221FBA1320697e, 0x8532fa14acaf483729c449b8458aeddb900543d4, and 0x8d53903625b8e839b9DF4bd28B0EFb1CD6b8639A. We recommend treating this as unconfirmed until Binance issues an official statement. We will update as we verify more.

🚨Blockaid detected an ongoing exploit on @Fetch_ai on Ethereum. The same exploiter wallet then received a large NTX mint from the @nunet_global deployer account. ~$2.01M so far (~$1.56M FET drained from the converter + ~$452k NTX minted) across the cluster. Attack still ongoing. 🧵

Blockaid brings real-time transaction protection to @arc on @MetaMask. Arc provides the institutional-grade rails, MetaMask brings users onto them, and Blockaid adds a real-time security layer that protects those users at the point of every transaction. Learn more:

AI has accelerated attacks. Detection needs to keep pace. New safeguards are live in @MetaMask, powered by Blockaid. Our AI pairs LLMs and classification models in custom agent harnesses to catch investment and romance scams in real time. Learn more:

Real-time security that keeps pace with the onchain economy. Institutions are increasingly moving onchain, and security risk continues to grow. AI-accelerated threats have outpaced rules-based legacy monitoring. Today we're reintroducing Onchain Monitoring. Over the past year, we've significantly expanded what teams operating onchain can do: - Auto-Discovery builds a live and continually updated inventory of your assets, keeping coverage current - Dependency Mapping surfaces and tracks the infrastructure you rely on but don't control - Ecosystem Incidents Feed alerts on live incidents right in the product, so you can act immediately - Automated response workflows and a 24/7 war room with our threat intel team turn incident detection into action within minutes Learn more:

An attacker exploited an outdated Rain contract, draining $1.1M in user card balances from @avici, @useTria, and other crypto neobanks. Blockaid's Onchain Monitoring gives stablecoin card issuers the capability to detect exploits across their fleet of contract deployments. Read more:

Blockaid has partnered with @ipor_io Fusion to bring threat monitoring to its vault ecosystem. Onchain Monitoring is live across a first set of vaults, built to monitor, detect, investigate, and respond. Learn more:

Security scales with adoption. With stablecoin issuance and institutional activity surging on @KaiaChain, we've brought @blockaid_ onboard to handle automated threat response. 24/7 monitoring. Complete peace of mind.

Blockaid has partnered with @KaiaChain to secure its ecosystem. Onchain Monitoring is live across Kaia's contracts, wallets, and bridges, and Transaction Simulation validates every transaction before it is signed, so threats are caught before funds move. Learn more:

Blockaid has partnered with @mellowprotocol to secure its vault infrastructure. Onchain Monitoring is live across Mellow's vaults and the protocols their strategies touch, catching exploits and anomalous fund movement in real time. Learn more:

Every Core Vault knows what its operator can and can't do. Verifiers check each action against the vault mandate and reject anything outside it. Now, Mellow is moving its live monitoring to @blockaid_, adding another layer of oversight around the activity inside those rules.

Governance takeovers recently drained $22M via bought and borrowed votes. Blockaid's Cosigner adds an independent signer to multisig and MPC setups, validating what each transaction actually does so a malicious proposal fails to execute. Read more:

H1 2026 saw 212 security incidents and over $1 billion in losses. Blockaid Co-Founder and CEO @idobn joined @FINTECHTVglobal's Market Movers at the @NYSE to explain why attackers are shifting beyond smart contracts to target private keys through social engineering.

Leading tokenization platform @MidasRWA lets strategy managers deploy and execute investment strategies inside its MPC workspaces. With Blockaid's Onchain Monitoring and Cosigner embedded in its robust security framework, every strategy manager on Midas gains real-time protection against onchain threats. Read more:

In H1 2026 alone, onchain incidents hit an all-time high, 3.4x of all of 2025. Our team has worked alongside our customers and the industry to navigate these hacks. We have also continued to strengthen our exploit detection platform, our product offerings, and deeply integrated AI into our workflows. Today we're publishing the Blockaid H1 2026 Onchain Security Report, what we detected across the half, and how our product has matured to meet it.

Blockaid's End-User Protection gives wallets the ability to detect malicious transactions and warn their users before they sign. Proud to power real-time onchain security for @MetaMask, @rainbowdotme, @zerion, and others.