at 00:10:35 UTC on 30 October, Binance 14 signed a new authorization that reset its delegation, 3 hours 46 minutes after the sweep.
Hacken said the chain confirms Binance 14 signed a new authorization at 00:10:35 UTC on 30 October that reset its delegation, 3 hours 46 minutes after the sweep.
This line is our short summary of the quote below. The quote is the evidence.
On the timeline
Other claims from the same source
Hacken said an attacker emptied Binance hot wallets on 10 blockchains on the evening of 29 October 2026.
an attacker emptied Binance hot wallets on 10 blockchains
Hacken, quoting investigators, said the most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains.
The most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains.
Hacken said early signs on Ethereum pointed to phishing of the authorizations, which could explain Ethereum but none of the other chains.
Early signs on Ethereum pointed to phishing of the authorizations, which could explain Ethereum but none of the other chains.
Hacken recommended that wallet operators cap value and rate per wallet at the signer and hold new destinations for a second approval.
Cap value and rate per wallet at the signer and hold new destinations for a second approval
Hacken said Binance's statement that no private key leaked and investigators' view that Binance's signing system signed for the attacker can both be true.
Binance says it found no evidence that a private key leaked, while investigators say Binance's signing system signed for the attacker, and the two statements can both be true.