Statements

Teng said the hack hit Binance's own hot wallet, not customer funds. "We never use any customer funds, so they are not impacted," he said, adding that most user assets are held in cold wallets and only moved into a hot wallet when a user withdraws.

And almost certainly an inside job given the knowledge of Binance systems required.

Finally, no government has confirmed anything, whereas after the Bybit theft the FBI named North Korea within five days .

None of this is proof, and the most careful reading explains why. The overlap with Bitget is small, about $39,000 of Binance funds at the shared address against about $510,000 from Bitget, and that shows a shared laundering network, not necessarily the same hackers. The thief also left most of the stolen USDT unconverted for 37 minutes on Ethereum and 46 on Tron, where North Korean groups usually move faster. The laundering through market makers and lending protocols doesn't match the older pattern either, and the root cause is still unpublished, which that firm calls "the most diagnostic fact still missing."

The most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains.

Early signs on Ethereum pointed to phishing of the authorizations, which could explain Ethereum but none of the other chains.

Cap value and rate per wallet at the signer and hold new destinations for a second approval

Binance says it found no evidence that a private key leaked, while investigators say Binance's signing system signed for the attacker, and the two statements can both be true.

At Binance the delegation stayed for 3 hours 46 minutes after the sweep and later deposits were swept again

Nobody outside Binance knows whether a policy layer was set, what it checked, or how an attacker managed to get signatures out of it.

Most of the money left in about 20 minutes, and a smaller second wave hit Avalanche and Polygon around 23:05 UTC.

Stablecoin issuers began freezing funds 56 minutes after the first transfer. Tether acted first, at 21:01, about 37 minutes after the big Ethereum transaction, and Circle followed three minutes later. Binance suspended deposits and withdrawals that night and published a written update at 02:23 UTC, a little over six hours after the first transfer.

Binance hasn't named a culprit. Teng said the investigation has not attributed responsibility to any individual, and Binance says it is working with law enforcement to confirm who is behind it.

The overlap with Bitget is small, about $39,000 of Binance funds at the shared address against about $510,000 from Bitget, and that shows a shared laundering network, not necessarily the same hackers. The thief also left most of the stolen USDT unconverted for 37 minutes on Ethereum and 46 on Tron, where North Korean groups usually move faster.

Stolen Binance funds were seen mixing, in real time, with funds from last month's Bitget theft, which had already been attributed to North Korean actors, and one firm calls that its strongest evidence. Funds from both thefts reached the same Ethereum address , as ZachXBT first reported.

Three analytics firms think so: two attribute the theft to TraderTraitor , a North Korean hacking unit, and the third calls it likely .

Ripple and World Liberty Financial froze their tokens inside the compromised wallet, which stopped new deposits of those tokens from being taken.

The event, meanwhile, also raises questions about why stronger approval controls were not in place, said Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab.

"This looks like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet," he said, referring to cryptocurrency wallets that hold users' "private keys," or unique authorizations, digitally and which are connected to the internet.

He added that while he doesn't manage Binance anymore, "as a shareholder, I expect all user funds will be fully covered."

Asked about the potential ties to North Korea, a Binance spokesperson said only that the company is "working closely with our law enforcement partners to confirm the identity of the criminals and bring them to justice."

Blockchain analysis company Chainalysis also believed the Binance hack was "likely done by DPRK group TraderTraitor," its co-founder and CEO Jonathan Levin wrote on X.

"Several features of this attack match earlier North Korea-linked heists, including the Bybit hack," TRM said.

That would make the hack the largest cryptocurrency theft on record, it said.

"An attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes," TRM said.