Around 20:20 UTC on October 29 (all times UTC), a Binance hot wallet was drained. Five other things happened in crypto over the next 48 hours. Only one of them, Jupiter Lend, was tied to the Binance news by the project itself. The rest happened in the same window, or their owners said they were unrelated. Below is each story, marked by whether it comes from the source itself or only from media reports.

1. Jupiter Lend: withdrawals stalled, then resumed

Jupiter Lend is a lending protocol on Solana. At 09:01 on October 30, its account @jupiter_earn said a liquidity crunch tied to overall market conditions was holding up withdrawals, and that withdrawals would resume as users deposited or repaid.

Most of the money in a lending pool is lent out. When many users try to pull USDC at once, the part that can be withdrawn right away runs dry until borrowers repay or new deposits arrive.

In a reply, Jupiter said it had no exposure to Binance, kept no funds there and lost nothing, and that users were seeing the market react to the news. Several outlets later reported a Jupiter update saying liquidity had been restored and USDC withdrawals were back to normal. We could not load that update directly, so it is marked as media-reported.

2. An Ethereum draft to switch off EIP-7702 delegation for good

EIP-7702 lets an ordinary wallet address (an EOA) delegate its execution to a smart contract. That gives plain wallets features like batched transactions. The risk is that anyone holding a valid signature can point the wallet at an attacker's contract.

According to Blockaid's analysis, as reported by crypto.news, the Binance attack used an EIP-7702 authorization to point the hot wallet at a contract that swept its funds.

On October 30, a draft appeared on GitHub as PR #12600, "Permanent EOA Delegation Opt-Out." A wallet sends one special transaction that marks the account, after which every 7702 authorization fails. The change cannot be undone. The address can still receive funds and make ordinary transfers.

Two caveats:

  • The draft does not mention Binance. Its motivation section says institutional wallets, exchange hot wallets and treasuries usually have no need for delegated execution.
  • The draft says it does not stop ordinary transfers if a private key leaks. It closes the delegation route only.

It is still a draft, not merged, and has no assigned number yet (the Ethereum Magicians thread title calls it EIP-8476).

3. Kintsu, Flap and StonkBrokers: suspected malicious scripts

Around 02:05 on October 31, a warning from security firm Blockaid spread on X: the websites of Kintsu, Flap and StonkBrokers appeared to carry injected scripts linked to the StepDrainer kit, and clicking "Connect wallet" could lead to a draining page. About eight minutes later, Flap said its site flap.sh had been hit by DNS hijacking and told users not to visit, connect a wallet or sign anything.

We could not load either post directly; their text comes from consistent reports across several outlets. Blockaid described script injection, while Flap described DNS hijacking. No source has confirmed whether these were one campaign or the same attackers, and none links them to the Binance hack.

4. Chainalysis was hacked, and says it is unrelated to Binance

Blockchain analytics firm Chainalysis posted a security notice on October 30. An outside actor using "offensive agentic techniques" (attacks run by automated AI agents) gained unauthorized access to its systems and internal tools this month.

The exposed data was platform user information: user IDs, full names, emails and organizational role labels. Chainalysis said it has seen no sign that investigation content, plaintext passwords, MFA keys or session tokens were accessed. It has not said how many customers were affected.

Chainalysis is one of the firms that attributed the Binance hack to North Korea-linked hackers, but its notice states this breach is unrelated to the Binance theft. It advised users to watch for password resets and verification requests they did not ask for, and to turn on two-factor authentication.

5. Tether Q3: $7.95 billion in excess reserves

On October 30, Tether published its reserve report as of September 30:

  • Total assets about $191.45 billion; total liabilities about $183.5 billion
  • Assets exceed liabilities by about $7.95 billion, up from about $4.1 billion at the end of Q2
  • Q3 net operating profit of $1.5 billion, mainly from US Treasuries and repurchase agreements
  • $132.4 billion in US Treasuries held directly and indirectly, plus about $19.1 billion in physical gold and about $8.4 billion in bitcoin

The report is an attestation by accounting firm BDO under ISAE 3000R, not a full financial audit. Its cut-off date comes before the Binance hack, so it is not a response to it.

What this means for regular users

  • Check the URL before you connect a wallet. A site can look normal and still have been swapped out.
  • Ignore password-reset emails or verification codes you did not request.
  • Lending-protocol withdrawals can stall when everyone withdraws at once. That is different from the protocol being hacked; go by the official announcements.

Sources