Binance founder CZ raises alarm on phishing link, meme coin spread via hacked X accounts

Binance founder Changpeng Zhao (CZ) has warned the crypto community about an inflating trend of phishing scams linked to the surging meme coin ￰0￱ remarks followed the hackers’ takeover of the official X account of BNB Chain, which they used to promote unauthorized token campaigns as well as fake ￰1￱ compromised account, followed by nearly four million users, was used to post fraudulent links in the form of legitimate Wallet Connect ￰2￱ users who interacted with these links risked exposing their private keys and losing their cryptocurrency ￰3￱ security firm SlowMist tracked the operation to a phishing domain that was very similar to the official BNB Chain website, except for a single ￰4￱ the rise of meme coins, hackers are targeting social media accounts (as they usually have lower security measures) to post ￰5￱ that official accounts do not endorse any specific memes. — CZ 🔶 BNB (@cz_binance) October 20, 2025 Researcher 23pds from SlowMist linked the domain to the notorious Inferno Drainer group – a collective known for developing wallet-draining templates and running large-scale phishing schemes since ￰6￱ security team responds swiftly Following the breach, CZ confirmed that the internal security team of Binance collaborated directly with X (previously Twitter) to suspend the hacked account and delete the phishing domains.

“The BNBCHAIN account is ￰7￱ hacker posted links to phishing ￰8￱ NOT connect your wallet,” Zhao posted on his personal X ￰9￱ reitaretad his SAFU (Secure Asset Fund for Users) post, reminding readers that they should be cautious even when the so-called verified or official accounts post the information. CZ’s caution highlights the complexity of the current phishing attacks that have begun to take advantage of brand ￰10￱ coins and fake airdrops are used as bait by attackers who attack crypto users via verified accounts and ￰11￱ pattern of crypto account breaches The BNB Chain incident is just one more addition to the increasing list of social media breaches that have rattled the crypto industry throughout ￰12￱ this year, a fake governance token was promoted to the X account of Pump.

fun, which had been hijacked. Similarly, another WIRED journalist’s account was used to promote a meme coin scam, which duped thousands of ￰13￱ week, PancakeSwap’s X account in Chinese was hacked to promote “Sir Pancake”, a fake token that, for a short time, generated almost $20 million in trading ￰14￱ day before, another fake meme coin called “4” was promoted via the BNB Chain hijacked account before the community regained ￰15￱ recently, scammers took over the official DOTA 2 YouTube channel to promote “dota2coin,” a Solana-based ￰16￱ livestream titled “Dota 2 Launch Official Meme Coin Hurry Up” had a ￰17￱ token link in it that redirected people back to the hacked ￰18￱ breaches have not been limited to crypto-native ￰19￱ March, Ghana’s former president, John Mahama’s X profile was hacked to advertise a counterfeit Solana token named Solanafrica.

A month later, UK government minister Lucy Powell’s account was used to promote a fraudulent “community” ￰20￱ high-profile institutions have gotten their ￰21￱ June, hackers gained access to Andreessen Horowitz’s (a16z) official X account to promote a fake $a16z ￰22￱ the same time, the account of Paraguay’s President, Santiago Peña, was compromised to falsely declare that Bitcoin had been declared legal tender in the ￰23￱ up to Bybit and start trading with $30,050 in welcome gifts