Statements

The operator wallet was funded from Tornado Cash starting the morning of October 28, in three withdrawals of about 0.098 ETH from the 0.1 ETH pool.

Bitquery notes that the XRP and Solana drains share no address with the rest of the operation and are tied to it only by timing and transaction construction

Either those transfers were signed earlier and held back, or the attacker's access outlived the pause.

My reading is persistence and independence. One signature bought unlimited, policy-free control of the largest wallet until someone revoked it, with no further requests through a compromised path that could be cut at any moment.

The question that decides the root cause is simple to state and impossible to answer from the outside: which identity caused which component to authorize which bytes, and why did that instruction pass?

Binance has confirmed the first two boxes, the chain shows the last four, and the dashed box in between is the one the post-mortem has to explain.

So either Binance’s signing path signs raw digests, or it supports 7702 authorizations as a message type and nothing in front of it objected to fifty of them. Both are inference.

An attacker holding the raw key would sign one authorization at submission time. Fifty pre-signed ones suggest someone who could get the key to sign digests but could not control when, how fast, or how many times.

Nine other chains lost money through nothing more exotic than correctly signed transfers, and that is the strongest evidence that the compromise sat in the signing path rather than in one wallet's key.

Nothing public establishes the infection method, the dwell time, the operating system or the malware.

The candidate paths are misuse of that service identity, modification of withdrawal requests in flight, deployment of altered code under a stronger identity, manipulation of policy or approvals, or direct access to a signing interface.

Link two is the one nobody has explained: how access to a container became accepted financial instructions.

and the only link Binance has confirmed so far is the first one. Everything between the laptop and the signatures is still inference

Once the investigation is complete, we will publish a post-incident report with further details on the incident.

Richard Teng, Binance's co-chief executive officer, said the hack was carried out by more than one person, and the hackers used sophisticated methods to hide their tracks, such as a "self-destruct mechanism".

Binance's initial investigation suggested an engineer's laptop was compromised, which allowed access to unauthorised withdrawals, but a later update said they had uncovered "additional points of breach".

Blockaid CEO Ido Ben-Natan said the attackers appeared to have compromised Binance’s transaction signing process. Binance said Friday that it had found no evidence of leaked wallet private keys, though its investigation remained ongoing.

The sweeper contract was only around 130 lines, Immunefi Vice President Simone Imbrescia said in a statement shared with The Block. "The hard part sometimes is getting access to a system powerful enough to make very simple code devastating," Imbrescia said.

Selig characterized the attack as a laptop-introduced vulnerability rather than a blockchain flaw—but Binance has since found “additional points of breach.”

This was not carried out by one person.

We expect to share further technical findings within about 48 hours once they have been verified and their disclosure will not compromise ongoing investigative efforts.

Our initial investigation suggested that the incident may involve a compromised laptop, however, our subsequent investigation has uncovered additional points of breach. At this stage, we have found no evidence that wallet private keys were leaked.

Teng said the hack hit Binance's own hot wallet, not customer funds. "We never use any customer funds, so they are not impacted," he said, adding that most user assets are held in cold wallets and only moved into a hot wallet when a user withdraws.

And almost certainly an inside job given the knowledge of Binance systems required.

The most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains.