On the same timeline, two security incidents outline a profile of misaligned gains: on one end, the trading platform Binance was hacked, an incident whose details have not yet been fully disclosed, is seen on-chain as an exacerbation of competitive interactions; Yu xian, the founder of Slow Mist, observed that Lido's 7-day average APR recently increased from about 2.2% to about 4.2%, attributing this to the enhancement of Ethereum execution layer rewards, leading stETH holders to experience unexpectedly amplified staking returns in this short window; on the other end, the direct cost of the attack on the cross-chain protocol zkLink was revealed—Slow Mist security team disclosed that attackers exploited a real cross-chain message to write in a verification value, then reused the transient storage’s residual verification value in subsequent calls of the same transaction to forge a batch root, bypassing withdrawal verification, successfully completing one ETH withdrawal and eleven ERC-20 token withdrawals, with cumulative losses of approximately $783,000. While the security incident quietly rewrites the yield curve through changes in execution layer rewards, it exposes systemic vulnerabilities via the bypassing of cross-chain verification, creating a contradiction that raises staking returns while amplifying infrastructure risks during the same period, becoming the starting point for all subsequent discussions.

Binance Theft Sparks On-Chain Battle

At the same time that the zkLink attack exposes the vulnerabilities in cross-chain verification, Slow Mist founder Yu xian turns his attention to the other end—Ethereum’s "on-chain battle" following the Binance hack. He believes that this security incident of the trading platform led to an unusually dense and intense competitive on-chain interaction, directly pushing up the reward levels of the Ethereum execution layer. Execution layer rewards essentially stem from the profits generated by on-chain transactions being packed and executed; staking protocols like Lido bundle part of the rewards belonging to validators with consensus layer staking profits, proportionally passing them to holders of staking certificates like stETH. It was in this context that Yu xian noted that Lido's 7-day average APR recently surged from about 2.2% to about 4.2%, nearly doubling in a short period; he directly attributed this steep earnings curve to the intensified on-chain interaction competition following the Binance hack and the simultaneous rise in execution layer rewards.

However, this causal chain extending from "trading platform hack" to "Ethereum execution layer reward increase" then to "Lido APR surge" currently relies almost entirely on the public analyses from Yu xian and his team for support. Existing materials neither disclose the specific amount stolen from Binance nor the details of the attack, and no similar directional explanations have been provided by Lido's officials or other independent security and data teams, lacking multi-source on-chain indicators to quantitatively verify the magnitude of changes in execution layer rewards. In the absence of multi-source on-chain data cross-verification, the relationship between the Binance hack and the Lido APR increase can only be viewed as a hypothesis from a single security team, rather than a fact jointly confirmed by the market and protocol layers.

Unexpected Dividends for stETH Holders

In this causal chain that has yet to be verified by multi-source data, those most directly feeling the changes are the holders of stETH. According to data provided by Yu xian, Lido's 7-day average APR recently increased from about 2.2% to about 4.2%, nearly a "doubling" within a short time. For most passive holders, they did not take active steps to increase their positions or adjust their strategies, yet they saw their daily earnings allocated to stETH noticeably thicker on the same staking position, this jump in “panel experience” can easily be interpreted as an unexpected windfall from the sky, rather than extra compensation earned from risk. Especially in the context that Lido did not announce any parameter adjustments, stETH holders may subconsciously attribute the surplus earnings of this period to the on-chain dividends brought by Ethereum staking and execution layer rewards.

However, based on the timeline and information sources, this more resembles a short-term fluctuation driven by events rather than a predictable, replicable new normal. Current materials only provide "recent two days" dimension of changes to the 7-day average APR, lacking longer-term trends and support from statistics provided by Lido, and the earnings increase may be quickly reversed once on-chain interactions stabilize again. More concerning is that behind this steep earnings curve corresponds with a simultaneous increase in security incidents and uncertainties in the entire environment: on one side, the hypothesis of intensified on-chain competition after the Binance hack; on the other side, the reality that cross-chain protocols such as zkLink are exposed to attacks. stETH holders enjoy additional returns overflowing in this turbulent background, rather than peace of mind interest after risk reduction; this reminds everyone that apparently attractive APR fluctuations often exist on the same timeline as the deterioration of overall security conditions.

zkLink Cross-Chain Vulnerability Exploited

On the same timeline as Lido's earnings curve unexpectedly rising, the zkLink attack disclosed by the Slow Mist security team sounds a more direct alarm for the cross-chain track. According to Slow Mist's analysis, the attackers caused losses of approximately $783,000 in this event, completing twelve withdrawal operations within a single transaction, of which only one was an ETH withdrawal, while the other eleven were withdrawals of ERC-20 tokens, with funds "normally" flowing out of the cross-chain protocol’s withdrawal logic in batches. On the surface, these withdrawals all passed the contract's verification process, but the real issue lay in the details of the transient storage following the writing of a cross-chain message.

Slow Mist's review pointed out that the key to the attack path was that the verification value written into transient storage was not securely destroyed. The attacker initiated a real cross-chain message interaction and followed the process to obtain and write in a legitimate verification value, then reused this residual verification value in subsequent calls of the same transaction to forge a root value that did not belong to that batch, thereby bypassing normal withdrawal verification. Since the contract still "trusted" the verification value in transient storage, the attacker was able to continuously complete multiple malicious withdrawals in a single transaction until the funds were taken. This forging of batch roots revolving around the remaining state of transient storage is a typical case of security risk in cross-chain protocols, constituting a substantive warning to all similar designs that rely on message verification and batch root checks.

Risks and Gains Linked by Security Incidents

Viewing the Binance hack and the zkLink attack on the same timeline is like a controlled experiment at both ends. On one end, according to Yu xian's disclosure, in this background of on-chain interaction competition ignited by the security incident, Lido's 7-day average APR surged from about 2.2% to about 4.2%, thus increasing the actual earnings of stETH holders over the past few days; on the other end, according to analysis by the Slow Mist security team, the cross-chain protocol zkLink experienced twelve consecutive withdrawal actions (one ETH, eleven ERC-20) in one attack utilizing residual verification values in transient storage, with final losses of about $783,000. The former represents an incidental gain from rising execution layer rewards, while the latter reflects theft following the bypassing of batch root verification. Both stem from fluctuations in the security environment, yet manifest in different protocols as misaligned results of increased earnings and total asset depletion. It is important to emphasize that Yu xian's causal judgment regarding the relationship between the Binance hack and the APR increase remains a single-source perspective, and its specific mechanism has not yet been independently verified by more data or official channels.

This misalignment behind indicates a shared challenge in security design and monitoring within the Ethereum staking ecosystem and the cross-chain protocol ecosystem: the staking side must realize that unusually high fee transactions and security incident-related interactions mixed in execution layer rewards may beautify APR in the short term, but may not represent effective risk management; the cross-chain side must confront structural vulnerabilities like zkLink that arise from the reuse of residual states in transient storage to ensure that any batch roots and cross-chain message verifications are not "replayed" by the states of the same transaction. When the same security shock simultaneously results in both rising stETH returns and zkLink asset theft, market participants must confront a reality: under the current architecture, risk exposure and income distribution can occur in stark misalignment between different protocols, and this misalignment itself is a core issue that requires continuous monitoring and correction.

Subsequent Observations: Earnings and Security Gray Rhino

When a security shock simultaneously raises Lido's 7-day APR and lowers zkLink user assets, this misalignment of gains and losses across different protocols itself is a gray rhino present. Yu xian's singular source judgment attributed the recent APR increase from about 2.2% to about 4.2% to a phased enhancement of Ethereum execution layer rewards after the Binance hack, rather than any proactive parameter adjustment by Lido, which implies that the portion of "extra" earnings on staking could likely be merely a byproduct of risk being repriced within the system. In contrast, on zkLink, attackers utilized residual verification values in transient storage to forge batch roots, completing one ETH and eleven ERC-20 malicious withdrawals within a single transaction, exposing weak points in cross-chain verification and transient storage management; as of October 31, 2026, no repair solutions or multiple rounds of audit results have been seen in the public materials. The next real variable to monitor closely is when and how Lido's enlarged staking earnings will recede, and how zkLink and similar cross-chain protocols will address verification procedures at the code level and introduce tighter audits, rather than seeking arbitrage opportunities in temporary APR fluctuations. For any address holding stETH or participating in cross-chain interactions, security should be viewed as a long-term structural issue that pervades architectural design, incentive distribution, and risk control processes, rather than easily digestible noise from a single incident or a period of temporary high earnings.

Join our community for discussions and become stronger together!
AiCoin exclusive Hyperliquid benefits: https://app.hyperliquid.xyz/join/AICOIN88
AiCoin exclusive Aster benefits: https://www.asterdex.com/zh-CN/referral/9C50e2
On-chain Telegram community: https://t.me/AiCoinWhaleData
On-chain community: https://www.aicoin.com/link/chat?cid=N6OVMor5g
AiCoin on-chain Twitter: https://x.com/aicoinwhaledata

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到[email protected]，本平台相关工作人员将会进行核查。