Hypernative

@BancoCentralBR is advancing to contract Hypernative to operate a continuous onchain monitoring and fraud intelligence program for Brazil's financial sector. The engagement follows a proof of value in which we built a BCB-specific detection methodology from scratch: multi-layer agents tracking BRL/crypto volume anomalies across major Brazilian exchanges, cross-exchange synchronicity signals, intraday velocity patterns, and behavioral markers calibrated against known incident fingerprints. The decisive proof point: a preparatory alert issued 14 hours before a confirmed fraud incident. Several high-confidence alerts generated during the PoC were later associated with confirmed incident activity, supporting the thesis that fraud-to-crypto laundering can produce detectable setup patterns before full dispersion. BCB is becoming Hypernative's first central bank customer. The program is now live as a productized regulatory intelligence operation, with continuous monitoring, methodology maintenance, onchain investigation support, and dedicated analyst hours. 🔗 Read the announcement (EN): buff.ly/hiyCsPf 📰 Article in BitNotícias (pt_BR): buff.ly/GLXsA7V

KPK’s agents acted within seconds of an alert, from Morpho exits to Gearbox pauses. This is what Hypernative is built for: giving teams the real-time signal to take whatever action they need, when it matters. We're very happy to be part of @kpk_io's stack and play our part in a positive result.🤝

BitMart-linked wallets were drained on November 2 by the address behind the Mercado Bitcoin attack. Here's what we know so far: What we know → From 01:22 UTC on November 2, BitMart-linked wallets on Base, Optimism and Arbitrum sent funds to the attacker address used in the Mercado Bitcoin attack. → Public estimates put losses at ~$391K. → The drains started about an hour before the first Mercado Bitcoin outflow. → BitMart's founder confirmed the hack on November 3 and described the amount as small. He said it may be the same group behind the Mercado Bitcoin attack. Timeline (UTC) 1️⃣ Nov 2, 01:22: The attacker begins draining BitMart-linked wallets. 2️⃣ About an hour later: The first Mercado Bitcoin outflow. 3️⃣ Nov 2, 20:20: A second drain on Base sends funds to another attacker wallet. 4️⃣ Nov 3: BitMart's founder confirms the hack. What to do → Screen and block inbound funds from the attacker addresses below. → If you still hold funds on BitMart, review that exposure. Attacker addresses EVM (all chains): →0xe485e7a70b1131216cb47ca4555c4bbb2c742478 → Second Base drain recipient: 0x8419e7824e785c4ac8d9d94a0093c437ab1ff320 Affected wallet: → BitMart 21 (Arbitrum): 0xb4af4d0b9bd38c9f2fec9778e48667912f778f01

Last chance to register. Our live security briefing on the Binance hack starts today at 10am ET / 3pm GMT. Register → buff.ly/B6YtezA 🇧🇷 Joining from Brazil? Tomorrow, 5 Nov, we’re running a session in Portuguese with ABToken. Register → buff.ly/is0DmpL

US$ 6,3 bi saíram das hot wallets da Binance, a maior parte em cerca de 1 hora. A própria infraestrutura assinou tudo. PSAVs em autorização no Banco Central do Brasil: seus controles impediriam isso? Briefing ao vivo com a ABToken 👇 buff.ly/iJvJdIi

How did $6.3B+ leave Binance’s hot wallets in under an hour? And what should other teams learn from it? Binance’s initial investigation points to an attacker gaining access to an internal service that could submit withdrawals. From there, the attacker was able to get legitimate signatures on their transfers. On Ethereum, a signed delegation also allowed the attacker’s code to control a hot wallet. For teams holding funds onchain, this raises a critical question: what stops a malicious transaction when the signature is valid? Join our Co-founder & CTO, Dan Caspi for a security briefing covering how the attack unfolded, the early warning signs and practical checks for your signing systems and withdrawal controls. Bring your questions for the live Q&A. We’ll send out the recording if you can’t join live. 🔗 buff.ly/B6YtezA

Step 4 of a governance attack: ⚔️ execute. If a proposal passes, the execution delay is the only thing between the vote and the money. In the Max Planck study, nine of 24 onchain voting DAOs had no delay at all. But a delay only creates a window. Whether it is worth anything depends on who is watching during it. Read more in our primer on malicious governance attacks: buff.ly/19yXU5E

The Binance breach is the largest crypto theft on record, with $6.3B drained from hot wallets in under an hour. The loss raises a critical question for any organization managing digital assets: what stops your systems from signing a malicious request? Our review covers what happened, how the attack worked, and what it means for teams across the industry. Read it here → buff.ly/PWrIbFV Dan Caspi walks through the attack live on Wednesday 4 November, 10am ET / 3pm GMT → buff.ly/B6YtezA

Onchain data now confirms Binance hot wallets were drained. Here's what we know so far: → From about 20:10 UTC, Binance hot wallets on Ethereum, Arbitrum, Optimism, Base, Solana and Bitcoin, and likely Tron and Avalanche, sent funds to fresh attacker addresses. → Losses are $3.6B+, with public estimates up to ~$5.8B. → Every outflow was authorized with the hot wallets' own keys . How the attacker got signing access is not yet known. → On Ethereum, Binance 14 was taken over with EIP-7702 and is still delegated to the attacker's contract. → Tether and Circle have frozen part of the stolen USDT and USDC. ETH, SOL, BTC and most other tokens can't be frozen and some are already moving. Timeline (UTC) 1️⃣ 02:28: The attacker deploys a test version of a drainer contract. 2️⃣ 15:59: The drainer contract goes live. Only the attacker can call it. 3️⃣ ~20:10: Binance hot wallets begin sending funds to attacker addresses. 4️⃣ 20:20: One transaction carrying 50 pre-signed authorizations from Binance 14 delegates the wallet to the drainer contract. 5️⃣ 20:24: A single call sweeps ~167K ETH and ~64 tokens from Binance 14. 6️⃣ 20:41 and 20:59: The same delegation is used to move ~$823M USDC out of another Binance contract. 7️⃣ 21:04: Binance 14 is swept again. 8️⃣ Since then: USDT was swapped to ETH ahead of the freezes, and BTC is being split into 1,000 BTC chunks. What to do → Keep exposure to Binance reduced until Binance confirms its hot wallets are secure. → Do not send funds to Binance 14 (0x28c6c06298d514db089934071355e5743bf21d60). It is still delegated to the attacker's contract, so anything that arrives there can be swept. → Exchanges, OTC desks, bridges and other venues taking deposits: screen and block inbound funds from the attacker address (0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c).

⚡ If you're in Mumbai for IBW, DSS, and Devcon mark your calendars and get on over to the DeFi Security Summit to see Hypernative's expert Akand Sitra break down everything you need to know about onchain security. 🗓️ Nov 2 🕐 1pm IST 🛎️ Marriott Mumbai Akand's work puts him right at the focal point of critical security deployments. In his talk he'll cover why point in time audits and checks are not enough to keep pace of attacks, how attacks propogate, and what are the most effective monitoring and response vectors to keep track of. You don't want to miss it!

The pool you screened before entering isn’t the pool you’re in today. Bad actors can join after you deposit. Deciding whether to stay is a different call from deciding whether to enter. Full panel on-demand: hypernative.io/insights/even…

🤝 Hypernative is proud to partner with @Cordaxyz to bring AML and sanctions monitoring to institutional structured products onchain on @solana. Every depositing wallet is screened alongside KYC before capital moves, with compliance built into the onboarding flow from day one.

✈️ 🇮🇳 Hypernative is heading to Mumbai! Come and meet the team at: → India Blockchain Week → DeFi Security Summit → Devcon 8 🔊 And don't miss Akand's talk at DSS on Nov 2 at 1pm IST covering real-time monitoring for Web3 security.

The Hypernative team will be boots on the ground at @TheTieIO's The Bridge in NYC on Oct 27 🗽 Alex Rabke, Marshall Lipman, Travis Vigneault and Tucker Kennedy will be present to dive into what it takes to run institutional digital asset exposure without losing sleep over exploits. We're looking forward to some great conversations.

Your due diligence can cover every wallet and still miss the pools your funds sit in. When a regulator asks why you were in that pool, “we didn’t know” isn’t an answer. Full panel on-demand: hypernative.io/insights/even…

On October 9, 2026, an attacker deployed a malicious contract on Berachain targeting @realBeraFarm. Hypernative flagged it in seconds, and an automated pause fired on @KodiakFi, blocking the exploit before a single transaction ran. BeraFarm wasn’t a Hypernative customer. The pause protected them anyway. $250K saved, with zero human-in-the-loop required at the moment of execution. Full breakdown here: hypernative.io/insights/blog…