Independent record. Not associated with, endorsed by or operated by Binance. This site is read-only: there is nothing to sign in to, pay for or connect.

binancebreach.com

An independent record of the October 2026 Binance hack

All theories

Theory Open

A compromised vendor or software supply chain was involved

Commenters and analysts asked whether a vendor or supply chain compromise was involved. Binance said it found additional points of breach beyond an engineer's laptop. Elliptic said the theft resembles Bybit, where a developer's machine at the wallet provider Safe{Wallet} was compromised.

This is a theory, not an established fact. First seen . Updated .

What the evidence does and does not show

In the sources captured as of 2026-11-01, Binance has not said whether any third-party vendor was involved. Its updates describe an engineer's laptop and additional points of breach without detail. The Polymarket compromise earlier on 29 October involved a third-party provider, but the Guardian called it an unrelated incident. Chainalysis said its own breach is not related to the Binance theft. We found no source in the sources captured as of 2026-11-01 that links a vendor compromise to Binance. The promised post-mortem may settle this.

Evidence

Evidence for (0)

None recorded yet.

Evidence against (2)

Reported

The Guardian reported that, in an incident it described as unrelated, the prediction market operator Polymarket temporarily halted trading earlier on Thursday after a security incident involving a third-party provider.

In an unrelated incident earlier on Thursday, the prediction market operator Polymarket temporarily halted trading after a security incident involving a third-party provider.

The Guardian. Captured . Original

Note: The Guardian calls the Polymarket halt unrelated.

Theory

A Hacker News commenter replied that the actors behind that supply chain attack did not seem to have the skills to reach a full Binance compromise within hours.

I don't think those people have the skills needed to elevate their initial access to a full binance compromise within a few hours.

Hacker News. Captured . Original

Note: Replies that the other attack's actors lacked the skills to reach Binance in hours.

Context (4)

Reported

Hacken said nobody outside Binance knows whether a policy layer was set on the signing system, what it checked, or how the attacker obtained signatures.

Nobody outside Binance knows whether a policy layer was set, what it checked, or how an attacker managed to get signatures out of it.

Hacken. Captured . Original

Note: Signing-system design not public. (in the sources captured as of 2026-11-01)

Reported

Elliptic said the Binance theft closely resembles the Bybit theft, in which a developer's machine at the wallet provider Safe{Wallet} was compromised.

This closely resembles the Bybit theft, in which North Korean hackers compromised a developer's machine at the wallet provider Safe{Wallet} and manipulated the transaction that Bybit's signers approved.

Elliptic, Elliptic. Captured . Original

Note: Bybit loss involved a compromised developer machine at Safe{Wallet}.

Reported

The Block reported that Chainalysis said its own breach is not related to the Binance theft.

Chainalysis said the incident is "not related to the recent crypto theft at Binance."

Chainalysis, The Block. Captured . Original

Note: Chainalysis says its own breach is unrelated.

Official

Binance said in its Security Incident Update #2 that its subsequent investigation had uncovered additional points of breach beyond a possibly compromised laptop, and that it had found no evidence that wallet private keys were leaked.

Our initial investigation suggested that the incident may involve a compromised laptop, however, our subsequent investigation has uncovered additional points of breach. At this stage, we have found no evidence that wallet private keys were leaked.

Binance, Binance. Captured . Original

Note: Binance found additional points of breach.