The most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains.
Hacken, quoting investigators, said the most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains.
This line is our short summary of the quote below. The quote is the evidence.
Cited in theories
- EIP-7702 caused the hack: Evidence against. Signing system signed across chains.
- The Ethereum authorizations were phished: Evidence against. Most likely the signing system signed.
Other claims from the same source
Hacken said an attacker emptied Binance hot wallets on 10 blockchains on the evening of 29 October 2026.
an attacker emptied Binance hot wallets on 10 blockchains
Hacken said early signs on Ethereum pointed to phishing of the authorizations, which could explain Ethereum but none of the other chains.
Early signs on Ethereum pointed to phishing of the authorizations, which could explain Ethereum but none of the other chains.
Hacken recommended that wallet operators cap value and rate per wallet at the signer and hold new destinations for a second approval.
Cap value and rate per wallet at the signer and hold new destinations for a second approval
Hacken said Binance's statement that no private key leaked and investigators' view that Binance's signing system signed for the attacker can both be true.
Binance says it found no evidence that a private key leaked, while investigators say Binance's signing system signed for the attacker, and the two statements can both be true.
Hacken, before the FBI statement, said no government had confirmed anything about attribution, whereas after the Bybit theft the FBI had named North Korea within five days.
Finally, no government has confirmed anything, whereas after the Bybit theft the FBI