Independent record. Not associated with, endorsed by or operated by Binance. This site is read-only: there is nothing to sign in to, pay for or connect.
Hacken wrote that the root cause is still unpublished, which, it wrote, "that firm" calls "the most diagnostic fact still missing". The passage follows Hacken's link to an Elliptic analysis, which it calls "the most careful reading".
This line is our short summary of the quote below. The quote is the evidence.
ReportedattributionStatement 911
None of this is proof, and the most careful reading explains why. The overlap with Bitget is small, about $39,000 of Binance funds at the shared address against about $510,000 from Bitget, and that shows a shared laundering network, not necessarily the same hackers. The thief also left most of the stolen USDT unconverted for 37 minutes on Ethereum and 46 on Tron, where North Korean groups usually move faster. The laundering through market makers and lending protocols doesn't match the older pattern either, and the root cause is still unpublished, which that firm calls "the most diagnostic fact still missing."
The North Korea attribution is wrong or premature: Evidence for. Hacken: root cause still unpublished. Hacken's text gives "the most diagnostic fact still missing" to the Elliptic analysis it links.
The most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains.
Binance says it found no evidence that a private key leaked, while investigators say Binance's signing system signed for the attacker, and the two statements can both be true.