Independent record. Not associated with, endorsed by or operated by Binance. This site is read-only: there is nothing to sign in to, pay for or connect.

The Binance Hack

An independent record of the October 2026 Binance hack

Attack reconstruction: Internal movement

Back to the overview · Previous stage: Initial access · Next stage: Withdrawal transactions

The claims placed under one stage of the attack, each with its source. The quote, the capture time and the hash of the stored copy are on the statement page that each line links to. Which stage a claim sits under is chosen by keywords in its one-line summary, so it is a reading aid and not a finding.

33 approved claims under this stage.

Internal movement

What sources say happened between that first foothold and the ability to move funds: which internal systems were reached and whether keys were involved.

  1. Reported root cause

    TRM Labs indicated that funds sent from other chains through ordinary signed transfers point to a compromise of Binance's hot wallet signing infrastructure rather than a flaw in Ethereum.

    TRM Labs, Decrypt. Original Statement 659 Captured .

  2. Reported root cause

    Blockaid said the attacker first drained a Binance wallet it calls Binance 14 starting 20:24 UTC in a single transaction worth about $2.5B, minutes after Binance's own signing infrastructure, which it said was under the attacker's control, signed an EIP-7702 authorization delegating it to an attacker-deployed sweeper.

    blockaid.io. Original Statement 104 Captured .

  3. Reported root cause

    Binance co-CEO Richard Teng said the attacker did not simply use one engineer's permissions and that it was not a single 'one-click' action.

    Richard Teng, Hacken. Original Statement 25 Captured .

  4. Reported root cause

    Richard Teng explained that hackers manipulated a transaction approval system to move money from a hot wallet without passing through normal controls.

    Richard Teng, Yahoo Finance. Original Statement 213 Captured .

  5. Reported root cause

    Cointelegraph quoted Ido Ben-Natan as describing "a compromise of signing infrastructure" and saying "We don't think a key was leaked."

    Ido Ben-Natan, Cointelegraph. Original Statement 475 Captured .

  6. Official root cause

    Binance said in its Security Incident Update dated 2026-10-30 that its initial investigation suggested the incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to access a service container and submit unauthorized withdrawal transactions, and that it had found no evidence of any wallet private key leak.

    Binance, Binance. Original Statement 161 Captured .

  7. Reported root cause

    Cointelegraph reported that Binance said its investigation had uncovered additional points of breach after initially pointing to a possibly compromised laptop, and that it remained on track to resume withdrawals in 45 hours.

    Binance, Cointelegraph. Original Statement 129 Captured .

  8. Reported root cause

    Cointelegraph quoted Ido Ben-Natan as saying that ultimately the signer signed a transaction that they shouldn't have.

    Ido Ben-Natan, Cointelegraph. Original Statement 356 Captured .

  9. Reported root cause

    Cointelegraph reported that co-CEO Richard Teng said the attacker used an EIP-7702 delegation to gain execution authority over a hot wallet, and that the delegation did not pass through Binance's normal approval controls.

    Richard Teng, Cointelegraph. Original Statement 134 Captured .

  10. Official root cause

    Binance said in its Security Incident Update #2 that its subsequent investigation had uncovered additional points of breach beyond a possibly compromised laptop, and that it had found no evidence that wallet private keys were leaked.

    Binance, Binance. Original Statement 171 Captured .

No time stated

  1. No time stated
    Reported root cause

    Binance's initial investigation suggested an engineer's laptop was compromised, allowing access to unauthorised withdrawals, but a later update said they had uncovered additional points of breach.

    Binance, BBC News. Original Statement 8 Captured .

  2. No time stated
    Reported root cause

    Richard Teng, Binance's co-chief executive officer, stated that the hack was carried out by more than one person using sophisticated methods to hide their tracks.

    Richard Teng, BBC News. Original Statement 9 Captured .

  3. No time stated
    Reported root cause

    Binance stated that an initial investigation suggested the incident may have involved a compromised laptop, but a subsequent investigation uncovered additional points of breach.

    Binance, npr.org. Original Statement 44 Captured .

  4. No time stated
    Reported root cause

    Binance initially linked the breach to a compromised DevOps engineer's laptop but later stated it uncovered additional points of breach in a complex attack not carried out by one person.

    Binance, Elliptic. Original Statement 56 Captured .

  5. No time stated
    Reported root cause

    TRM said that in its assessment the most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains.

    TRM Labs, TRM Labs. Original Statement 150 Captured .

  6. No time stated
    Reported root cause

    Blockaid CEO Ido Ben-Natan stated that the attackers appeared to have compromised Binance’s transaction signing process.

    Ido Ben-Natan, Cointelegraph. Original Statement 278 Captured .

  7. No time stated
    Reported root cause

    Elliptic reported that Richard Teng said in a video update that the attack was not carried out by one person.

    Elliptic, Elliptic. Original Statement 308 Captured .

  8. No time stated
    Reported root causesays something is unexplained

    Hacken said nobody outside Binance knows whether a policy layer was set on the signing system, what it checked, or how the attacker obtained signatures.

    Hacken. Original Statement 316 Captured .

  9. No time stated
    Reported root cause

    Hacken said Binance's statement that no private key leaked and investigators' view that Binance's signing system signed for the attacker can both be true.

    Hacken. Original Statement 323 Captured .

  10. No time stated
    Reported other

    Hacken recommended that wallet operators cap value and rate per wallet at the signer and hold new destinations for a second approval.

    Hacken. Original Statement 324 Captured .

  11. No time stated
    Reported root cause

    Hacken, quoting investigators, said the most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains.

    Hacken. Original Statement 326 Captured .

  12. No time stated
    Reported root cause

    NPR reported that Kok Tin Gan of NyxLab said the event raises questions about why stronger approval controls were not in place.

    Kok Tin Gan, npr.org. Original Statement 331 Captured .

  13. No time stated
    Reported root cause

    The BBC quoted Binance co-CEO Richard Teng as saying this was not carried out by one person.

    Richard Teng, BBC News. Original Statement 337 Captured .

  14. No time stated
    Reported root cause

    Ido Ben-Natan said attackers may have used a compromised developer’s computer to gain access to Binance’s wallet-signing infrastructure.

    Ido Ben-Natan, Cointelegraph. Original Statement 464 Captured .

  15. No time stated
    Reported root causesays something is unexplained

    Halborn said the only link in the attack chain Binance had confirmed so far was the first one, and that everything between the laptop and the signatures was still inference.

    Halborn. Original Statement 751 Captured .

  16. No time stated
    Reported root causesays something is unexplained

    Halborn said how access to a container became accepted financial instructions was the link nobody had explained.

    Halborn. Original Statement 752 Captured .

  17. No time stated
    Reported root cause

    Halborn listed five candidate paths from the container to accepted withdrawals, without saying which was used.

    Halborn. Original Statement 753 Captured .

  18. No time stated
    Reported root cause

    Halborn said nine other chains lost funds through correctly signed transfers, which it called the strongest evidence that the compromise sat in the signing path rather than in one wallet's key.

    Halborn. Original Statement 755 Captured .

  19. No time stated
    Reported root cause

    Halborn said that whether Binance's signing path signs raw digests or accepts EIP-7702 authorizations as a message type is inference, and that only Binance's signer request log can settle it.

    Halborn. Original Statement 757 Captured .

  20. No time stated
    Reported root causesays something is unexplained

    Halborn said Binance had confirmed the first two boxes of its attack-chain diagram and that the box in between was the one the post-mortem has to explain.

    Halborn. Original Statement 758 Captured .

  21. No time stated
    Reported root cause

    Halborn said the question that decides the root cause is which identity caused which component to authorize which bytes, and why that instruction passed, and that it cannot be answered from outside.

    Halborn. Original Statement 759 Captured .

  22. No time stated
    Reported amount

    Halborn said that on October 29, 2026, between 20:05 and 23:56 UTC, an attacker moved about 6.3 billion dollars out of Binance's hot wallets on ten blockchains, and that nobody had yet shown that a private key was stolen.

    Halborn. Original Statement 973 Captured .

  23. No time stated
    Reported root cause

    Halborn said that in both the Bybit and Binance incidents the legitimate signing system produced a valid signature for the attacker's transaction, and that in neither was a key broken, extracted or, as far as anyone can show, copied.

    Halborn. Original Statement 994 Captured .