Reportedroot causeStatement 25
co-CEO Richard Teng said the attacker "did not simply use one engineer's permissions, and this was not a single 'one-click' action."
Binance co-CEO Richard Teng said the attacker did not simply use one engineer's permissions and that it was not a single 'one-click' action.
This line is our short summary of the quote below. The quote is the evidence.
Other statements from the same source
ReportedattributionStatement 912
Hacken wrote that no government had confirmed anything, whereas after the Bybit theft the FBI named North Korea within five days.
Finally, no government has confirmed anything, whereas after the Bybit theft the FBI named North Korea within five days .
ReportedattributionStatement 911
Hacken wrote that the root cause is still unpublished, which, it wrote, "that firm" calls "the most diagnostic fact still missing". The passage follows Hacken's link to an Elliptic analysis, which it calls "the most careful reading".
None of this is proof, and the most careful reading explains why. The overlap with Bitget is small, about $39,000 of Binance funds at the shared address against about $510,000 from Bitget, and that shows a shared laundering network, not necessarily the same hackers. The thief also left most of the stolen USDT unconverted for 37 minutes on Ethereum and 46 on Tron, where North Korean groups usually move faster. The laundering through market makers and lending protocols doesn't match the older pattern either, and the root cause is still unpublished, which that firm calls "the most diagnostic fact still missing."
Reportedroot causeStatement 326
Hacken, quoting investigators, said the most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains.
The most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains.
Reportedroot causeStatement 325
Hacken said early signs on Ethereum pointed to phishing of the authorizations, which could explain Ethereum but none of the other chains.
Early signs on Ethereum pointed to phishing of the authorizations, which could explain Ethereum but none of the other chains.
ReportedotherStatement 324
Hacken recommended that wallet operators cap value and rate per wallet at the signer and hold new destinations for a second approval.
Cap value and rate per wallet at the signer and hold new destinations for a second approval