Independent record. Not associated with, endorsed by or operated by Binance. We will never ask you to connect a wallet, log in or pay to recover funds.
An independent record of the October 2026 Binance hack
This line is our short summary of the quote below. The quote is the evidence.
"This looks like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet," he said, referring to cryptocurrency wallets that hold users' "private keys," or unique authorizations, digitally and which are connected to the internet.
Reviewer note: Opinion from a security firm CEO about how the attack worked, hedged ('looks like'). Not a finding.
The event, meanwhile, also raises questions about why stronger approval controls were not in place, said Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab.
He added that while he doesn't manage Binance anymore, "as a shareholder, I expect all user funds will be fully covered."
Asked about the potential ties to North Korea, a Binance spokesperson said only that the company is "working closely with our law enforcement partners to confirm the identity of the criminals and bring them to justice."
Blockchain analysis company Chainalysis also believed the Binance hack was "likely done by DPRK group TraderTraitor," its co-founder and CEO Jonathan Levin wrote on X.
"Several features of this attack match earlier North Korea-linked heists, including the Bybit hack," TRM said.