Independent record. Not associated with, endorsed by or operated by Binance. This site is read-only: there is nothing to sign in to, pay for or connect.

binancebreach.com

An independent record of the October 2026 Binance hack

All theories

Theory Unsupported

Was an insider involved? Commenters' question, no evidence reported

No source captured as of 2026-11-01 reports evidence that an insider was involved, and no investigator or official in those sources has said so. Some Hacker News commenters asked whether the theft was an inside job, and one wrote that it was almost certainly an inside job given the knowledge of Binance systems the attack needed. This is speculation by commenters.

This is a theory, not an established fact. First seen . Updated .

What the evidence does and does not show

Commenters point to the knowledge of Binance systems the attack needed. Binance's co-CEO said the investigation has not attributed responsibility to any individual. The FBI says North Korea's TraderTraitor group is responsible. We found no source, in the sources captured as of 2026-11-01, that reports evidence of knowing insider involvement. In the sources captured as of 2026-11-01, Binance has not yet published its post-mortem, so how the attacker obtained the signatures is not public. We do not identify or comment on any individual.

Evidence

Evidence for (0)

None recorded yet.

Evidence against (1)

Official

The FBI said in an alert dated October 31, 2026 that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about October 29, 2026, and that it refers to this North Korean activity as TraderTraitor.

The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026. The FBI refers to this specific North Korean malicious cyber activity as "TraderTraitor."

Federal Bureau of Investigation (FBI), FBI. Captured . Original

Note: The FBI attributes the theft to North Korea.

Context (7)

Reported

Hacken said nobody outside Binance knows whether a policy layer was set on the signing system, what it checked, or how the attacker obtained signatures.

Nobody outside Binance knows whether a policy layer was set, what it checked, or how an attacker managed to get signatures out of it.

Hacken. Captured . Original

Note: How signatures were obtained is not public. (in the sources captured as of 2026-11-01)

Reported

Elliptic reported that Richard Teng said in a video update that the attack was not carried out by one person.

Teng added that the attack "was not carried out by one person"

Elliptic, Elliptic. Captured . Original

Note: Teng said the attack was not carried out by one person.

Reported

TRM Labs said preparation began at least 36 hours before the theft, with the operator wallet receiving three small Tornado Cash withdrawals from the morning of 28 October.

Preparation began at least 36 hours before the theft. The attacker's operator wallet received three small withdrawals from Tornado Cash, a service that obscures where crypto comes from, starting the morning of October 28.

TRM Labs, TRM Labs. Captured . Original

Note: Preparation traced on-chain, including test runs.

Reported

Cointelegraph reported that the speaker wrote that Binance's investigation has not attributed responsibility to any individual.

“Our investigation has not attributed responsibility to any individual,” he wrote.

Richard Teng, Cointelegraph. Captured . Original

Note: Binance has not attributed responsibility to any individual. (in the sources captured as of 2026-11-01)

Theory

A Hacker News commenter commented that the hack was almost certainly an inside job given the knowledge of Binance systems required.

And almost certainly an inside job given the knowledge of Binance systems required.

Hacker News. Captured . Original

Note: Commenter's view, no evidence given. (in the sources captured as of 2026-11-01)

Theory

A Hacker News commenter wrote that a risk management system should not let $5bn be transferred instantly, and wondered whether it was an inside job.

You split it into thousands and then use hardware security modules with a risk management system so it doesn't let you transfer $5bn instantly. Unless it was an inside job maybe? I'd be really curious to know what their security architecture was.

Hacker News. Captured . Original

Note: Asks about an inside job after noting the size of the transfers.

Theory

A Hacker News commenter asked whether there was actually a hack into Binance systems or just an insider or credential leak.

Was there actually a hack into binance systems, or was it just some insider or credential leak?

Hacker News. Captured . Original

Note: A question, not an assertion.