Independent record. Not associated with, endorsed by or operated by Binance. This site is read-only: there is nothing to sign in to, pay for or connect.

binancebreach.com

An independent record of the October 2026 Binance hack

All theories

Theory Open

Questions raised about approval controls during the 20-minute transfer

TRM Labs and WIRED report that most of the money left in about 20 minutes. Kok Tin Gan of NyxLab told NPR the event raises questions about why stronger approval controls were not in place. Binance co-CEO Richard Teng said the attacker's delegation did not pass through normal approval controls.

This is a theory, not an established fact. First seen . Updated .

What the evidence does and does not show

Sources agree the main drain took about 20 minutes, with one Ethereum transaction of about $2.53B at 20:24 UTC. Blockaid says it flagged the drain under two minutes after the sweep and that the delegation was visible on-chain for 3 minutes 24 seconds before it. Hacken says the delegation stayed in place for 3 hours 46 minutes and that nobody outside Binance knows whether a policy layer was set. In the sources captured as of 2026-11-01, Binance has not said when it first detected the transfers or what limits its signing system applied. The attacker destroyed tooling and traces, Teng said, which complicates the investigation. The post-mortem Binance promised should answer these points.

Evidence

Evidence for (5)

Reported

Hacken said nobody outside Binance knows whether a policy layer was set on the signing system, what it checked, or how the attacker obtained signatures.

Nobody outside Binance knows whether a policy layer was set, what it checked, or how an attacker managed to get signatures out of it.

Hacken. Captured . Original

Note: Policy layer unknown. (in the sources captured as of 2026-11-01)

Reported

Hacken said that at Binance the delegation stayed in place for 3 hours 46 minutes after the sweep and later deposits were swept again.

At Binance the delegation stayed for 3 hours 46 minutes after the sweep and later deposits were swept again

Hacken. Captured . Original

Note: Delegation stayed 3 hours 46 minutes.

Reported

NPR reported that Kok Tin Gan of NyxLab said the event raises questions about why stronger approval controls were not in place.

The event, meanwhile, also raises questions about why stronger approval controls were not in place, said Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab.

Kok Tin Gan, npr.org. Captured . Original

Note: Questions about approval controls.

Reported

Blockaid said the delegation was visible on-chain for three minutes and 24 seconds before the sweep.

The delegation itself was visible onchain for three minutes and 24 seconds before the sweep

blockaid.io. Captured . Original

Note: Delegation visible for 3 minutes 24 seconds before the sweep.

Reported

Blockaid said its detection flagged the drain under two minutes after the sweep and before any public report.

Blockaid’s detection flagged the drain under two minutes after the sweep and before any public report

blockaid.io. Captured . Original

Note: An outside firm flagged it within two minutes.

Evidence against (1)

Reported

Cointelegraph reported that Richard Teng said the attacker used a self-destruct mechanism to destroy tools and traces, complicating the investigation.

Teng also disclosed that the attacker used a “self-destruct mechanism” to destroy tools and traces during the breach, complicating the investigation.

Richard Teng, Cointelegraph. Captured . Original

Note: Teng says the attacker destroyed tooling and traces.

Context (6)

Reported

Hacken said stablecoin issuers began freezing 56 minutes after the first transfer, that Tether acted first at 21:01 and Circle three minutes later, and that Binance suspended deposits and withdrawals that night and published a written update at 02:23 UTC.

Stablecoin issuers began freezing funds 56 minutes after the first transfer. Tether acted first, at 21:01, about 37 minutes after the big Ethereum transaction, and Circle followed three minutes later. Binance suspended deposits and withdrawals that night and published a written update at 02:23 UTC, a little over six hours after the first transfer.

Hacken. Captured . Original

Note: First freezes 56 minutes after the first transfer.

Reported

Hacken said most of the money left in about 20 minutes, with a smaller second wave on Avalanche and Polygon around 23:05 UTC.

Most of the money left in about 20 minutes, and a smaller second wave hit Avalanche and Polygon around 23:05 UTC.

Hacken. Captured . Original

Note: Hacken agrees on about 20 minutes.

Reported

Hacken recommended that wallet operators cap value and rate per wallet at the signer and hold new destinations for a second approval.

Cap value and rate per wallet at the signer and hold new destinations for a second approval

Hacken. Captured . Original

Note: Hacken's suggested limits.

Reported

WIRED reported, citing TRM Labs, that the majority of the stolen crypto was taken in around 20 minutes on 29 October.

The majority of the stolen crypto was taken in a period of around 20 minutes on October 29, according to analysis by crypto tracing firm TRM Labs.

WIRED. Captured . Original

Note: Most funds taken in about 20 minutes.

Reported

Cointelegraph reported that blockchain researcher Spreek first raised concerns, posting on X that assets from a Binance-linked Ethereum wallet had been moved to a newly created address through a contract call allegedly funded by Tornado Cash.

Concerns were first raised by blockchain researcher Spreek, who posted on X that assets from a Binance-linked Ethereum wallet had been transferred to a newly created address through a contract call allegedly funded by Tornado Cash.

Spreek, Cointelegraph. Captured . Original

Note: An on-chain researcher raised the first alert.

Reported

Cointelegraph reported that co-CEO Richard Teng said the attacker used an EIP-7702 delegation to gain execution authority over a hot wallet, and that the delegation did not pass through Binance's normal approval controls.

The attacker used an EIP-7702 delegation to gain execution authority over a hot wallet, Teng said. That delegation “did not pass through our normal approval controls.”

Richard Teng, Cointelegraph. Captured . Original

Note: Delegation did not pass through normal approval controls.