Was the Binance hack an inside job? What the evidence shows four days later.

01 What the claim says

The posts cite five things. Billions left across many chains in minutes. Every transaction carried a valid signature. The Bitcoin moved in oddly structured steps. Some tokens were swapped at a steep discount. And Binance’s reserves snapshot came after it had refilled the wallets.

After FTX, nobody should wave this away on reputation alone. So we checked each point against what the investigators published.

02 What the evidence says

Speed and valid signatures. An attacker who controls the signing system gets both. TRM Labs found 50 pre-signed EIP-7702 authorisations that let attacker software sweep an Ethereum hot wallet, and assessed the hot-wallet signing infrastructure as compromised [ The Deep Dive, citing TRM Labs ] . One compromised signer explains ten chains in twenty minutes.

Odd Bitcoin movements and cheap swaps. TRM read the Bitcoin pattern as a peel chain, a routine laundering technique. Dumping stablecoins at a loss also makes sense for a thief racing Tether and Circle before they freeze the tokens. Elliptic found the laundering itself runs like software: a wallet on Tron paid out every hour for 31 hours, to about 200 wallets, with no overnight pause [ Elliptic ] .

The reserves snapshot. Here the critics have a fair point. A snapshot taken after Binance replaced the funds cannot show what the books looked like before. That proves nothing either way, and it is the one question only Binance can close.

Who did it. TRM Labs and Chainalysis attribute the theft to TraderTraitor, the North Korean unit the FBI blamed for Bybit in 2025. The FBI itself has so far said only that it is engaged with partners [ Nextgov ] . Binance says it will absorb the loss and had backed up to 90% of the stolen assets by 1 November [ CNBC ] .

03 The part both stories share

Binance co-CEO Richard Teng has said the attack was not limited to one engineer’s permissions, and that the transfer bypassed standard approval procedures [ Cointribune ] . Read that twice. An outside attacker and a dishonest insider need the same thing: a path where a large action goes through without the normal check. Binance had one.

The time to close it matters too. The malicious delegation went live at about 20:21 UTC on 29 October. Bitquery saw unauthorised transfers until 23:56, and the authorisation was revoked at 00:10 on 30 October [ The Deep Dive ] . That is close to four hours from first link to revoke.

You will never hold $6 billion in a hot wallet. You do have payment runs, payroll changes, admin consoles and data exports. Find out which of them one person can push through alone, before someone else does. Enterprise-grade. Not enterprise-priced.