Reportedroot causeStatement 316
Nobody outside Binance knows whether a policy layer was set, what it checked, or how an attacker managed to get signatures out of it.
Hacken said nobody outside Binance knows whether a policy layer was set on the signing system, what it checked, or how the attacker obtained signatures.
This line is our short summary of the quote below. The quote is the evidence.
Cited in theories
- A compromised vendor or software supply chain was involved: Context. Signing-system design not public. (in the sources captured as of 2026-11-01)
- Questions raised about approval controls during the 20-minute transfer: Evidence for. Policy layer unknown. (in the sources captured as of 2026-11-01)
- Was an insider involved? Commenters' question, no evidence reported: Context. How signatures were obtained is not public. (in the sources captured as of 2026-11-01)
Other statements from the same source
ReportedattributionStatement 912
Hacken wrote that no government had confirmed anything, whereas after the Bybit theft the FBI named North Korea within five days.
Finally, no government has confirmed anything, whereas after the Bybit theft the FBI named North Korea within five days .
ReportedattributionStatement 911
Hacken wrote that the root cause is still unpublished, which, it wrote, "that firm" calls "the most diagnostic fact still missing". The passage follows Hacken's link to an Elliptic analysis, which it calls "the most careful reading".
None of this is proof, and the most careful reading explains why. The overlap with Bitget is small, about $39,000 of Binance funds at the shared address against about $510,000 from Bitget, and that shows a shared laundering network, not necessarily the same hackers. The thief also left most of the stolen USDT unconverted for 37 minutes on Ethereum and 46 on Tron, where North Korean groups usually move faster. The laundering through market makers and lending protocols doesn't match the older pattern either, and the root cause is still unpublished, which that firm calls "the most diagnostic fact still missing."
Reportedroot causeStatement 326
Hacken, quoting investigators, said the most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains.
The most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains.
Reportedroot causeStatement 325
Hacken said early signs on Ethereum pointed to phishing of the authorizations, which could explain Ethereum but none of the other chains.
Early signs on Ethereum pointed to phishing of the authorizations, which could explain Ethereum but none of the other chains.
ReportedotherStatement 324
Hacken recommended that wallet operators cap value and rate per wallet at the signer and hold new destinations for a second approval.
Cap value and rate per wallet at the signer and hold new destinations for a second approval