Binance feared target of coordinated attack on X after billion-dollar hack

The multi-billion-dollar hack at Binance could have a striking follow-up. As the crypto exchange tries to limit the $6.3 billion in damage, hundreds of accounts on X are spreading negative posts about the platform. New research shows that 1,083 accounts published 11,700 posts between them within roughly 78 hours, generating almost 21 million views. According to the researcher, the patterns point to possible coordination, with accounts linked to competing crypto ecosystems also standing out.

Thousands of posts spread panic over Binance

The research focuses on the period from 30 October to 2 November inclusive, immediately after the huge hack at Binance.

The researcher analysed 11,700 posts from 1,083 selected accounts. Of these, 3,354 posts were identified as false information, spread across fifteen different types of rumour.

Notably, 79.6% of the posts were replies to existing posts. According to the researcher, some accounts use this to make negative narratives visible in places where many users are reading.

The content also shifts each time Binance shares new information.

When the exchange promises to reimburse all losses, more allegations of possible internal involvement appear. As soon as Binance discloses the scale of the hack, attention shifts to rumours of financial problems.

After the announcement that withdrawals will resume, several accounts instead urge users to remove their funds immediately.

Accounts around OKX and Hyperliquid also stand out

According to the research, 452 of the 641 most active accounts show interconnections. Within that group, 444 accounts form a single connected network, which an algorithm divides into eleven groups.

The researcher also looks at the platforms with which accounts appear to be affiliated, based on their public posts and interactions.

Within the network examined, 63 accounts are classified as OKX-aligned. Together they publish 343 negative posts, generating around 917,000 views.

In addition, 23 accounts are linked to the ecosystem around Hyperliquid. According to the analysis, this relatively small group accounts for 14.3% of views within the network studied.

However, this does not mean that OKX or Hyperliquid are behind the posts. The research provides no direct evidence that these companies direct, pay or instruct accounts to attack Binance.

Interactions can also arise because users follow the same topics.

Nearly 90% of accounts suddenly active

Another striking result is that 964 of the 1,083 accounts studied normally post very little about Binance.

During the incident, their combined activity rises to an average of 3,228 posts per day, roughly 24.6 times the normal level.

Not every negative reaction is suspicious, however. The research acknowledges that many users are rightly asking questions about the safety of their money and the temporary block on withdrawals.

The sample is also specifically made up of accounts with strikingly negative or potentially coordinated behaviour. The figures therefore do not indicate how many of all Binance posts on X are misleading.

According to the author, large accounts mainly generate reach, while smaller accounts post many replies.

The main conclusion is therefore that there are indications of organised influence around the Binance hack, but that the parties responsible remain unknown.