BNB Chain’s X Account Hacked — Here’s What Happened

On October 1, 2025, the official BNB Chain account on X (formerly Twitter) was compromised. The attacker used the account to post 10 phishing links, encouraging users to connect their wallets via fraudulent sites.

Changpeng Zhao (“CZ”) quickly tweeted an alert:

“ALERT : The @BNBCHAIN X account is compromised. The hacker posted a bunch of links to phishing websites that ask for Wallet Connect. Do NOT connect your wallet. Security teams have notified X… investigating.”

Within hours, the BNB Chain team managed to regain control of the account.

Losses and Impact

The scale of the damage was limited compared to large-scale heists, but still significant:

• The total stolen across several blockchains was about US $8,000.
• The single largest victim lost $6,500.
• Some reports mention a broader figure of around $13,000, likely reflecting additional chain movements or related losses.

Because the attack was executed through phishing links via the social media account, users who fell for it effectively gave permission to transfer funds.

CZ’s Official Response and Compensation

CZ and the BNB Chain team responded rapidly:

• CZ confirmed the hack publicly and urged users not to click on suspicious links.
• They emphasized that the root cause is under investigation and further security measures will follow.
• Crucially, all affected users will be compensated in full.

This promise aligns with broader practices in the crypto space, where exchanges or projects sometimes use reserve funds or insurance-like mechanisms to cover losses. Binance, for instance, maintains a Secure Asset Fund for Users (SAFU) to alleviate impact in extreme cases.

Takeaways and Precautions

• Social media accounts of crypto projects are high-value targets. Even if your funds are safe on-chain, phishing attacks can target trust and community.
• Always treat links from project accounts with caution—especially when they ask you to connect wallets.
• Use strong security hygiene: hardware wallets, checking URLs carefully, enabling multi-factor authentication.
• Keep an eye on official channels (project websites, verified handles) during incidents—official statements matter.