UPD: This is related to the Polymarket security incident, not Binance. Sorry, I missed that.

Per Changpeng Zhao (former Binance CEO):

This seems to be caused by DebugBear compromise: https://x.com/debugbear/status/2115866496643535293?s=46&t=_R...

it appears to be an injection attack on the front end. injecting incorrect tx, but showing a valid tx for the user to sign.

Link: https://x.com/cz_binance/status/2115880474375749834?s=46&t=_...