Binance founder Changpeng Zhao (CZ) addressed the community with a warning about the rise of phishing attacks disguised as memecoin giveaways. The reason was the hijacking of the official BNB Chain account on X (formerly Twitter), through which attackers distributed links to fake sites.
Hack and phishing scheme
The BNB Chain account, followed by almost four million users, was used to publish fake links under the guise of Wallet Connect messages. Users who clicked on them risked losing funds — malicious sites stole private keys.
According to SlowMist, the domains to which victims were redirected visually copied the official BNB Chain website, differing by only one letter in the address. Researcher 23pds linked these resources to the Inferno Drainer group, known for developing wallet theft templates and conducting mass phishing campaigns since 2022.
Binance’s response and CZ’s warning
The Binance security team responded quickly and, together with X, blocked the hacked account and removed the domains. Zhao himself confirmed the incident and published a warning:
‘BNBCHAIN account hacked. Hackers posted links to phishing sites. Do not connect wallets.’
CZ once again reminded users of the SAFU (Secure Asset Fund for Users) principle and emphasized that caution is necessary even when interacting with “trusted” or official pages.
He noted that attackers are increasingly exploiting trust in brands and well-known accounts, promoting fake tokens and fraudulent airdrops. Memecoins have become a convenient cover for attacks targeting a mass audience.
Wave of attacks against crypto projects
The BNB Chain incident became part of a growing series of cyberattacks on official accounts of crypto projects and public figures. In 2025, PancakeSwap, Pump.fun, as well as accounts of journalists and government officials, were hacked.
For example, in the Chinese version of PancakeSwap, hackers promoted a fake token Sir Pancake, which gained almost $20 million in turnover within a few hours. A day later, another fictitious memecoin called 4 was advertised on the hacked BNB Chain account.
Later, attackers took over the official DOTA 2 YouTube channel, where they streamed a “dota2coin token launch” on Solana. The video contained a link to Pump.fun, leading back to a fake channel.
The attacks were not limited to the crypto industry. In March, the account of former Ghanaian president John Mahama was hacked, where a fake token Solanafrica was promoted. A month later, a similar attack occurred on the page of UK government minister Lucy Powell.
Even the venture fund Andreessen Horowitz (a16z) and the president of Paraguay, Santiago Peña, ended up among the victims — their accounts were used to promote fictitious tokens and false statements about “bitcoin legalization.”
What’s next?
The scale of the attacks shows how vulnerable even the largest market players remain. CZ emphasized that the industry needs stricter account verification, transparent security systems, and improved digital literacy among users.
According to analysts, using memecoins as bait is a new stage in the evolution of phishing schemes, and fighting them will require joint efforts from companies and regulators.
Read more: Bitcoin recovers after correction. A bullish flag with growth potential up to +70% is forming on the charts
