Independent record. Not associated with, endorsed by or operated by Binance. This site is read-only: there is nothing to sign in to, pay for or connect.

binancebreach.com

An independent record of the October 2026 Binance hack

All theories

Theory Contradicted

The Ethereum authorizations were phished

Early indicators on the Ethereum activity suggested the attacker had phished the authorizations, according to TRM Labs and Hacken.

This is a theory, not an established fact. First seen . Updated .

What the evidence does and does not show

Both firms said this would explain Ethereum but none of the other chains. TRM Labs says wallets on the other nine chains sent funds through ordinary signed transfers. Blockaid's CEO and later analyses point to a compromise of the signing system, not a leaked key. Binance says it found no evidence of a private key leak. No source in the sources captured as of 2026-11-01 now defends the phishing explanation.

Evidence

Evidence for (2)

Reported

Hacken said early signs on Ethereum pointed to phishing of the authorizations, which could explain Ethereum but none of the other chains.

Early signs on Ethereum pointed to phishing of the authorizations, which could explain Ethereum but none of the other chains.

Hacken. Captured . Original

Note: Hacken: early signs pointed to phishing.

Reported

TRM Labs said early indicators suggested the attacker had phished the Ethereum authorizations, but that this leaves the other chains unexplained.

Early indicators on the Ethereum activity suggested the attacker had phished the authorizations. That explanation covers Ethereum and leaves the other chains unexplained.

TRM Labs, TRM Labs. Captured . Original

Note: TRM: early indicators suggested phishing.

Evidence against (4)

Reported

Hacken, quoting investigators, said the most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains.

The most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains.

Hacken. Captured . Original

Note: Most likely the signing system signed.

Reported

The page states that eleven Binance hot-wallet keys signed transfers to an address created minutes earlier, and one signed an EIP-7702 authorization.

Eleven Binance hot-wallet keys signed transfers to an address created minutes earlier, and one of them signed an EIP-7702 authorization that turned its wallet into standing infrastructure for the attacker.

blockaid.io. Captured . Original

Note: Eleven hot-wallet keys signed transfers.

Reported

TRM Labs said that on the nine chains other than Ethereum, Binance wallets sent funds to the attacker through ordinary signed transfers.

Binance wallets on the other nine chains sent funds to the attacker through ordinary signed transfers.

TRM Labs, TRM Labs. Captured . Original

Note: Other chains used ordinary signed transfers.

Reported

Cointelegraph quoted Blockaid CEO Ido Ben-Natan as describing a compromise of signing infrastructure and saying he did not think a key was leaked.

a compromise of signing infrastructure. We don’t think a key was leaked,” he said.

Ido Ben-Natan, Cointelegraph. Captured . Original

Note: Blockaid's CEO: signing infrastructure compromised, key not leaked.

Context (1)

Reported

Hacken said Binance's statement that no private key leaked and investigators' view that Binance's signing system signed for the attacker can both be true.

Binance says it found no evidence that a private key leaked, while investigators say Binance's signing system signed for the attacker, and the two statements can both be true.

Hacken. Captured . Original

Note: No key leak and a compromised signing system can both be true.