ReportedattributionStatement 539
TRM cited similarities to previous North Korean operations, including Tornado Cash funding, advance staging and pre-signed authorizations.
Independent record. Not associated with, endorsed by or operated by Binance. This site is read-only: there is nothing to sign in to, pay for or connect.
An independent record of the October 2026 Binance hack
This line is our short summary of the quote below. The quote is the evidence.
TRM cited similarities to previous North Korean operations, including Tornado Cash funding, advance staging and pre-signed authorizations.
Elliptic also cautioned that the onchain overlap with the Bitget incident involved only a small portion of the Binance funds and did not conclusively establish that the same attackers were responsible.