an attacker emptied Binance hot wallets on 10 blockchains
Hacken said an attacker emptied Binance hot wallets on 10 blockchains on the evening of 29 October 2026.
This line is our short summary of the quote below. The quote is the evidence.
Flagged as conflicting
- Hacken says the attacker emptied hot wallets on 10 blockchains. Elliptic says 11 blockchains. The captured quotes do not reconcile the two counts. Compare with Elliptic said the attacker drained Binance hot wallets across 11 blockchains over a few hours. (Elliptic). Side by side
Other claims from the same source
Hacken, quoting investigators, said the most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains.
The most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains.
Hacken said early signs on Ethereum pointed to phishing of the authorizations, which could explain Ethereum but none of the other chains.
Early signs on Ethereum pointed to phishing of the authorizations, which could explain Ethereum but none of the other chains.
Hacken recommended that wallet operators cap value and rate per wallet at the signer and hold new destinations for a second approval.
Cap value and rate per wallet at the signer and hold new destinations for a second approval
Hacken said Binance's statement that no private key leaked and investigators' view that Binance's signing system signed for the attacker can both be true.
Binance says it found no evidence that a private key leaked, while investigators say Binance's signing system signed for the attacker, and the two statements can both be true.
Hacken, before the FBI statement, said no government had confirmed anything about attribution, whereas after the Bybit theft the FBI had named North Korea within five days.
Finally, no government has confirmed anything, whereas after the Bybit theft the FBI