Independent record. Not associated with, endorsed by or operated by Binance. This site is read-only: there is nothing to sign in to, pay for or connect.
An independent record of the October 2026 Binance hack
Every entry here is a theory: speculation, attributed to whoever proposed it. Each shows the quoted evidence for, against and context. A status says how the collected evidence compares. It is not a finding of fact.
Theories are not facts. This section collects speculation that others have published, including unverified forum comments, each with its source. We do not endorse any theory or say that it is true, and nothing here accuses any person or company of wrongdoing.
This is a question, not an allegation. We looked for anyone saying that someone traded on advance knowledge of the theft, and as of 2026-11-01 we have found no source that says so, either in our stored copies or in a web search. It says nothing about any person or firm.
Evidence for: 0. Evidence against: 0. Context: 3. Updated .
A Hacker News commenter wrote "inside job /exit strategy" on the night of the theft, which suggests the theft was staged or used as a way out. The comment is one line and gives no reasoning. A Reddit commenter compared the situation with exit scams while saying Binance was probably not one, and another Hacker News commenter disagreed with the suggestion. These are unverified forum comments.
Evidence for: 1. Evidence against: 4. Context: 4. Updated .
After Binance co-CEO Richard Teng said the attacker used an EIP-7702 delegation, some commenters treated the Ethereum feature as the cause. Ethereum community member VEER said it gave attackers a handy sweep button on Ethereum.
Evidence for: 3. Evidence against: 4. Context: 3. Updated .
Some firms and commenters raised doubts about attributing the theft to North Korea's TraderTraitor group. Before the FBI statement, Hacken wrote "None of this is proof" and pointed to what it calls "the most careful reading", an Elliptic analysis it links, as explaining why. The passage lists a small overlap with funds from the Bitget theft and a slower pace of conversion than it said North Korean groups usually show. On Hacker News, two commenters suggested North Korea was a convenient or politically attractive target to blame.
Evidence for: 4. Evidence against: 7. Context: 4. Updated .
Reports of automated laundering led to questions about AI agents. Chainalysis said the attackers appear to use automation. A separate Chainalysis breach was described by The Block as the work of an AI-assisted hacker. Elliptic said whether the automation involves AI agents cannot be determined from on-chain data.
Evidence for: 0. Evidence against: 1. Context: 4. Updated .
TRM Labs and WIRED report that most of the money left in about 20 minutes. Kok Tin Gan of NyxLab told NPR the event raises questions about why stronger approval controls were not in place. Binance co-CEO Richard Teng said the attacker's delegation did not pass through normal approval controls.
Evidence for: 5. Evidence against: 1. Context: 6. Updated .
Early indicators on the Ethereum activity suggested the attacker had phished the authorizations, according to TRM Labs and Hacken.
Evidence for: 2. Evidence against: 4. Context: 1. Updated .
Commenters and analysts asked whether a vendor or supply chain compromise was involved. Binance said it found additional points of breach beyond an engineer's laptop. Elliptic said the theft resembles Bybit, where a developer's machine at the wallet provider Safe{Wallet} was compromised.
Evidence for: 0. Evidence against: 2. Context: 4. Updated .
The theft came days before a US election and while the Clarity Act was stalled in the Senate. A separate Polymarket compromise happened the same day. Politicians used the hack in arguments about crypto legislation.
Evidence for: 0. Evidence against: 3. Context: 7. Updated .
Nansen and CertiK's CEO put Binance's emergency fund at about $1.16B to $1.17B. Binance puts the loss at about $6.3B and describes its SAFU fund as an emergency reserve fund. CertiK's CEO estimated frozen assets plus the emergency fund would cover about 66% of the loss.
Evidence for: 3. Evidence against: 0. Context: 3. Updated .
After the theft, some analysts and online commenters asked whether Binance can cover the loss. CertiK's CEO estimated that frozen assets plus Binance's emergency fund could cover about 66% of the losses, leaving a potential $2.1 billion gap.
Evidence for: 5. Evidence against: 7. Context: 6. Updated .
No source captured as of 2026-11-01 reports evidence that an insider was involved, and no investigator or official in those sources has said so. Some Hacker News commenters asked whether the theft was an inside job, and one wrote that it was almost certainly an inside job given the knowledge of Binance systems the attack needed. This is speculation by commenters.
Evidence for: 0. Evidence against: 1. Context: 8. Updated .