Independent record. Not associated with, endorsed by or operated by Binance. This site is read-only: there is nothing to sign in to, pay for or connect.
An independent record of the October 2026 Binance hack
Newest first. The raw hash is the SHA-256 of the stored copy exactly as fetched. We keep the copy privately and publish its hash. The text hash is of the text extracted from it, which is what is compared between captures.
| Captured (UTC) | Fetched via | HTTP | Raw sha256 | Text sha256 | Text changed |
|---|---|---|---|---|---|
| firecrawl-web08 | 200 | 970c3b9ba88bba4a587093ee08f066c81456017c954b9fc04bcf15b67593ef04 | 99e9213122d96461b836f69833b2f866ae55a6266158ccb209aa5540728f32b0 | No |
No text changes detected between captures of this source.
At 13:51 they ran a rehearsal that is worth a second look: a test wallet delegated with three authorizations at nonces 0, 1 and 2, of which exactly one applied.
The final contract went live at 15:59, a second rehearsal exercised the sweep path three times between 16:25 and 16:47, and the test funds were routed back.
At 20:24:23 (3 minutes 24 seconds after the delegation), in block 26,300,770, the operator called Binance 14.
Between 20:30 and 20:33, before Tether acted, 700 million USDT left the hub in two transfers; Tether later caught 205 million of it one and two hops downstream.
Tether: blacklisted Binance 14 itself at 22:06.
Avalanche and Polygon were hit at 23:05, about half an hour after Binance had confirmed the incident and paused withdrawals.
The delegation was cleared at 00:10:35 on October 30, three hours and fifty minutes after it was installed.
and the only link Binance has confirmed so far is the first one. Everything between the laptop and the signatures is still inference
Link two is the one nobody has explained: how access to a container became accepted financial instructions.
The candidate paths are misuse of that service identity, modification of withdrawal requests in flight, deployment of altered code under a stronger identity, manipulation of policy or approvals, or direct access to a signing interface.
Nothing public establishes the infection method, the dwell time, the operating system or the malware.
Nine other chains lost money through nothing more exotic than correctly signed transfers, and that is the strongest evidence that the compromise sat in the signing path rather than in one wallet's key.
An attacker holding the raw key would sign one authorization at submission time. Fifty pre-signed ones suggest someone who could get the key to sign digests but could not control when, how fast, or how many times.
So either Binance’s signing path signs raw digests, or it supports 7702 authorizations as a message type and nothing in front of it objected to fifty of them. Both are inference.
Binance has confirmed the first two boxes, the chain shows the last four, and the dashed box in between is the one the post-mortem has to explain.
The question that decides the root cause is simple to state and impossible to answer from the outside: which identity caused which component to authorize which bytes, and why did that instruction pass?
Binance 16, the second Ethereum hot wallet, signed nine ordinary transfers to the attacker worth about $174 million, with no delegation at all.
My reading is persistence and independence. One signature bought unlimited, policy-free control of the largest wallet until someone revoked it, with no further requests through a compromised path that could be cut at any moment.
The issuers froze about 2.8 billion dollars, and most of it within 47 minutes of the main sweep, but the attacker had moved 700 million USDT out of the hub before the first freeze landed and converted close to 800 million dollars of stablecoins into assets nobody can freeze.
What the attacker keeps is what nobody can freeze. By Elliptic's count about 3.33 billion dollars sat in roughly 43 addresses: 511,861 ETH, 18,270 BTC, 233 million XRP and 670 million TRX, with about 445 million in XRP, SOL and NEAR that has not moved at all.
Either those transfers were signed earlier and held back, or the attacker's access outlived the pause.
Bitquery notes that the XRP and Solana drains share no address with the rest of the operation and are tied to it only by timing and transaction construction
The operator wallet was funded from Tornado Cash starting the morning of October 28, in three withdrawals of about 0.098 ETH from the 0.1 ETH pool.
On attribution, TRM states high confidence that this is TraderTraitor, the North Korean unit the FBI named for Bybit, on the basis of on-chain and off-chain intelligence it has not published.
Elliptic says likely, and lists its reasons: a laundering address shared with the September Bitget theft, 0x1510…feb7, although only about 39,000 dollars of Binance funds reached it against 510,000 linked to Bitget;
the preparation pattern of Tornado Cash funding, rehearsal and pre-signed bursts seen in Bybit and in KelpDAO in April; the targeting of staff, which matches the DMM Bitcoin case; and the capability to drain eleven chains in three hours.
Elliptic also lists the caveats: the shared address could be a launderer serving several clients, the stablecoins were held longer than North Korea usually holds them, the cash-out went through market makers and lending rather than bridges, and no government has said a word, whereas the FBI attributed Bybit within five days. Binance has named nobody.
My view is that the pattern fits and that a compliance team should act on it today rather than wait for a press release.
In Bybit, Sygnia traced the loss to a compromised developer workstation at the wallet provider, stolen cloud session tokens and a tampered signing interface. Same playbook, different entry. Precedent is not evidence, but it is a very good search warrant.