ReportedfreezeStatement 153
Another count dates the first freezes at 21:14.
Hacken said that another count dates the first freezes at 21:14, whereas its table lists Tether's freeze at 21:01.
This line is our short summary of the quote below. The quote is the evidence.
On the timeline
Other statements from the same source
ReportedattributionStatement 912
Hacken wrote that no government had confirmed anything, whereas after the Bybit theft the FBI named North Korea within five days.
Finally, no government has confirmed anything, whereas after the Bybit theft the FBI named North Korea within five days .
ReportedattributionStatement 911
Hacken wrote that the root cause is still unpublished, which, it wrote, "that firm" calls "the most diagnostic fact still missing". The passage follows Hacken's link to an Elliptic analysis, which it calls "the most careful reading".
None of this is proof, and the most careful reading explains why. The overlap with Bitget is small, about $39,000 of Binance funds at the shared address against about $510,000 from Bitget, and that shows a shared laundering network, not necessarily the same hackers. The thief also left most of the stolen USDT unconverted for 37 minutes on Ethereum and 46 on Tron, where North Korean groups usually move faster. The laundering through market makers and lending protocols doesn't match the older pattern either, and the root cause is still unpublished, which that firm calls "the most diagnostic fact still missing."
Reportedroot causeStatement 326
Hacken, quoting investigators, said the most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains.
The most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains.
Reportedroot causeStatement 325
Hacken said early signs on Ethereum pointed to phishing of the authorizations, which could explain Ethereum but none of the other chains.
Early signs on Ethereum pointed to phishing of the authorizations, which could explain Ethereum but none of the other chains.
ReportedotherStatement 324
Hacken recommended that wallet operators cap value and rate per wallet at the signer and hold new destinations for a second approval.
Cap value and rate per wallet at the signer and hold new destinations for a second approval