Reportedroot causeStatement 769
Either those transfers were signed earlier and held back, or the attacker's access outlived the pause.
Halborn offered two readings: either those transfers were signed earlier and held back, or the attacker's access outlived the pause.
This line is our short summary of the quote below. The quote is the evidence.
Other statements from the same source
ReportedwithdrawalsStatement 1002
Halborn said Binance's own pipeline pushed 200 million USDT into a compromised wallet eighty minutes after the drain.
Binance’s own pipeline pushed 200 million USDT into a compromised wallet eighty minutes after the drain.
ReportedamountStatement 1001
Halborn said Binance lost about four percent of what it held, which it said sounds like a conservative hot allocation until four percent is six billion.
Binance lost about four percent of what it held, which sounds like a conservative hot allocation until four percent is six billion.
Reportedroot causeStatement 994
Halborn said that in both the Bybit and Binance incidents the legitimate signing system produced a valid signature for the attacker's transaction, and that in neither was a key broken, extracted or, as far as anyone can show, copied.
In both, the legitimate signing system produced a valid signature for the attacker's transaction, and in neither was a key broken, extracted or, as far as anyone can show, copied.
ReportedamountStatement 973
Halborn said that on October 29, 2026, between 20:05 and 23:56 UTC, an attacker moved about 6.3 billion dollars out of Binance's hot wallets on ten blockchains, and that nobody had yet shown that a private key was stolen.
On October 29, 2026, between 20:05 and 23:56 UTC, an attacker moved about 6.3 billion dollars out of Binance's hot wallets on ten blockchains, and nobody has yet shown that a private key was stolen.
ReportedattributionStatement 779
Halborn said Sygnia traced the Bybit loss to a compromised developer workstation, stolen cloud session tokens and a tampered signing interface, called it the same playbook with a different entry, and added that precedent is not evidence.
In Bybit, Sygnia traced the loss to a compromised developer workstation at the wallet provider, stolen cloud session tokens and a tampered signing interface. Same playbook, different entry. Precedent is not evidence, but it is a very good search warrant.