Independent record. Not associated with, endorsed by or operated by Binance. We will never ask you to connect a wallet, log in or pay to recover funds.
An independent record of the October 2026 Binance hack
This line is our short summary of the quote below. The quote is the evidence.
Stolen Binance funds were seen mixing, in real time, with funds from last month's Bitget theft, which had already been attributed to North Korean actors, and one firm calls that its strongest evidence. Funds from both thefts reached the same Ethereum address , as ZachXBT first reported.
0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7, described as: Intermediary (Per Hacken, citing ZachXBT: the Ethereum address that funds from both the Binance and the Bitget thefts reached). Walletsan attacker emptied Binance hot wallets on 10 blockchains
The most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains.
Early signs on Ethereum pointed to phishing of the authorizations, which could explain Ethereum but none of the other chains.
Cap value and rate per wallet at the signer and hold new destinations for a second approval
Binance says it found no evidence that a private key leaked, while investigators say Binance's signing system signed for the attacker, and the two statements can both be true.