Independent record. Not associated with, endorsed by or operated by Binance. This site is read-only: there is nothing to sign in to, pay for or connect.
An independent record of the October 2026 Binance hack
This line is our short summary of the quote below. The quote is the evidence.
My reading is persistence and independence. One signature bought unlimited, policy-free control of the largest wallet until someone revoked it, with no further requests through a compromised path that could be cut at any moment.
In Bybit, Sygnia traced the loss to a compromised developer workstation at the wallet provider, stolen cloud session tokens and a tampered signing interface. Same playbook, different entry. Precedent is not evidence, but it is a very good search warrant.
My view is that the pattern fits and that a compliance team should act on it today rather than wait for a press release.
Elliptic also lists the caveats: the shared address could be a launderer serving several clients, the stablecoins were held longer than North Korea usually holds them, the cash-out went through market makers and lending rather than bridges, and no government has said a word, whereas the FBI attributed Bybit within five days. Binance has named nobody.
the preparation pattern of Tornado Cash funding, rehearsal and pre-signed bursts seen in Bybit and in KelpDAO in April; the targeting of staff, which matches the DMM Bitcoin case; and the capability to drain eleven chains in three hours.
Elliptic says likely, and lists its reasons: a laundering address shared with the September Bitget theft, 0x1510…feb7, although only about 39,000 dollars of Binance funds reached it against 510,000 linked to Bitget;