BNB Chain X Account Compromised: Fake HODLer Airdrop Drains Wallets, Binance Promises Full Compensation

BNB Chain’s Official X Account Hijacked to Push Phishing Scam Targeting Crypto Wallets

A major security breach shook the crypto community as the official English X account of BNB Chain, followed by nearly four million users, was compromised.

Hackers exploited the account to post fraudulent links promoting a “BNB HODLer Airdrop,” aimed at tricking users into connecting their wallets via WalletConnect, a common interface for accessing decentralized applications.

One of the malicious posts by the attackers, which has since been removed.

How Hackers Exploited Official Trust

The attackers filled the compromised account with posts containing links to fake websites that closely mimicked Binance’s legitimate portals.

The phishing pages used subtle tricks, such as swapping letters in the domain name, to appear authentic.

Security researchers, including SlowMist CISO known as 23pds, identified the operation as linked to the notorious Inferno phishing group, a service known for wallet-draining campaigns.

Users who connected their wallets risked immediate theft of funds.

CZ Confirms Breach and Urges Immediate Caution

Binance co-founder Changpeng Zhao (CZ) alerted millions of followers, emphasising,

“The hacker posted a bunch of links to phishing websites that ask for Wallet Connect. Do NOT connect your wallet.”

He warned the community to carefully verify domains, even when links appear on verified X accounts, and advised users to “Stay SAFU.”

CZ also confirmed that Binance’s security teams had notified X to temporarily suspend the account and filed takedown requests for the malicious websites.

Binance Moves Quickly to Contain BNB Chain Account Hack

Following the breach, Binance’s teams launched an investigation to regain full access to the BNB Chain account.

They coordinated with X to remove fraudulent posts and monitored for further phishing attempts. While the scam posts were deleted quickly, warnings remained for users who might have still encountered the links.

The incident raises questions about the security practices of high-profile crypto accounts, given the increasing frequency of similar takeovers in the sector.

Phishing Tactics Exploit WalletConnect Popularity

The attackers relied on WalletConnect, a widely used tool for linking wallets to dApps, to drain victims’ assets.

The posts promoted a fake airdrop labelled with random numbers, such as “BNB Chain HODLer Airdrop 435234,” creating urgency and legitimacy for users.

The scheme illustrates how cybercriminals exploit trust in official accounts to bypass conventional caution.

Security Experts Warn Users to Stay Vigilant

Experts caution that even verified and official accounts are vulnerable.

SlowMist’s 23pds highlighted,

“BNB Chain’s English official X account has been hacked! The phishing website changed the letter i into l.”

Source: X

The attackers directed users to a phishing website designed to steal wallet access. (Source: X)

The incident follows a trend of high-profile account compromises, including political figures and major crypto projects, emphasising the importance of independent verification of links and strict wallet security measures.

BNB Chain Restores Access and Confirms Compensation

BNB Chain has regained full control of its X account.

The breach resulted in an estimated $8,000 stolen, primarily from 10 phishing links, with the largest single loss being $6,500.

One phishing contract was deployed, through which the attacker initially injected $17,800 and exited their meme tokens for $22,000.

BNB Chain confirmed that all victims will be fully compensated.

They pledged continued transparency and reinforced their commitment to security measures, urging users to “Stay SAFU.”