Independent record. Not associated with, endorsed by or operated by Binance. This site is read-only: there is nothing to sign in to, pay for or connect.

The Binance Hack

An independent record of the October 2026 Binance hack

Attack reconstruction: Initial access

Back to the overview · Next stage: Internal movement

The claims placed under one stage of the attack, each with its source. The quote, the capture time and the hash of the stored copy are on the statement page that each line links to. Which stage a claim sits under is chosen by keywords in its one-line summary, so it is a reading aid and not a finding.

17 approved claims under this stage.

Initial access

What sources say about how the attacker first reached the systems involved, and any preparation they describe before the first transfer.

  1. Reported root cause

    TRM Labs stated that the attacker deployed code and tested it on wallets early on October 29 before installing it on a Binance hot wallet four hours later.

    TRM Labs, WIRED. Original Statement 379 Captured .

  2. Reported root cause

    Halborn said that at 13:51 the attacker ran a rehearsal on a test wallet delegated with three authorizations at nonces 0, 1 and 2, of which exactly one applied.

    Halborn. Original Statement 772 Captured .

  3. Reported root cause

    Halborn said the final contract went live at 15:59 and that a second rehearsal exercised the sweep path three times between 16:25 and 16:47.

    Halborn. Original Statement 773 Captured .

  4. Reported amount

    Spreek posted on X, labelling it unconfirmed, that an entire Binance wallet had been drained into a new EOA and that the contract call was funded by Tornado Cash.

    Spreek, X. Original Statement 780 Captured .

  5. Reported other

    Cointelegraph reported that blockchain researcher Spreek first raised concerns, posting on X that assets from a Binance-linked Ethereum wallet had been moved to a newly created address through a contract call allegedly funded by Tornado Cash.

    Spreek, Cointelegraph. Original Statement 112 Captured .

  6. Reported root cause

    Binance co-CEO Richard Teng described the breach as a complex attack involving a compromised laptop and malicious software designed to delete evidence.

    Richard Teng, Yahoo Finance. Original Statement 212 Captured .

  7. Reported root cause

    Binance's update of 02:23 UTC on October 30 stated that its initial investigation suggests the incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.

    Binance, Hacken. Original Statement 24 Captured .

  8. Reported root cause

    Cointelegraph reported that Richard Teng said the attacker used a self-destruct mechanism to destroy tools and traces, complicating the investigation.

    Richard Teng, Cointelegraph. Original Statement 340 Captured .

No time stated

  1. No time stated
    Reported root cause

    Blockaid said the operator address 0x7C8601d4645b93cea45F71e118A729332e6B5CA0 was funded through three Tornado Cash withdrawals starting October 28.

    blockaid.io. Original Statement 105 Captured .

  2. No time stated
    Reported root cause

    TRM Labs said preparation began at least 36 hours before the theft, with the operator wallet receiving three small Tornado Cash withdrawals from the morning of 28 October.

    TRM Labs, TRM Labs. Original Statement 301 Captured .

  3. No time stated
    Reported root causesays something is unexplained

    TRM Labs said early indicators suggested the attacker had phished the Ethereum authorizations, but that this leaves the other chains unexplained.

    TRM Labs, TRM Labs. Original Statement 303 Captured .

  4. No time stated
    Reported root cause

    Hacken said early signs on Ethereum pointed to phishing of the authorizations, which could explain Ethereum but none of the other chains.

    Hacken. Original Statement 325 Captured .

  5. No time stated
    Reported root cause

    Tom Robinson of Elliptic stated that Binance says the attack began with a compromised engineer's laptop, which is a hallmark of TraderTraitor.

    Tom Robinson, WIRED. Original Statement 382 Captured .

  6. No time stated
    Reported root cause

    Immunefi Vice President Simone Imbrescia stated that the sweeper contract used in the hack was only around 130 lines and that simple code can be devastating if access is powerful enough.

    Simone Imbrescia, The Block. Original Statement 529 Captured .

  7. No time stated
    Reported root cause

    CFTC Chairman Michael Selig characterized the attack as a vulnerability introduced from a laptop rather than a flaw in the blockchain.

    Michael Selig, Decrypt. Original Statement 594 Captured .

  8. No time stated
    Reported root causesays something is unexplained

    Halborn said nothing public establishes how the laptop was infected, how long the attacker had access, the operating system or the malware.

    Halborn. Original Statement 754 Captured .

  9. No time stated
    Reported root cause

    Halborn said the operator wallet was funded from Tornado Cash starting the morning of 28 October, in three withdrawals of about 0.098 ETH from the 0.1 ETH pool.

    Halborn. Original Statement 771 Captured .