An independent reconstruction by Cointegrity's Torstein Thinn finds that the Binance hackers never stole private keys. Instead, they hijacked the system that requests signatures. Several widely repeated claims about the hack turn out to be false.
Binance was hit last week by what now looks like the largest crypto theft ever. An attacker drained the company's wallets of roughly $6.3 billion across ten different blockchains. In the days since, numbers, theories and findings about how the attack happened, and who was behind it, have circulated widely. Torstein Thinn of Cointegrity, a firm that analyzes major incidents in the crypto sector for banks, regulators and police, has produced his own reconstruction of the event. It relies solely on public sources and data taken directly from the blockchain. Each finding is graded by how certain the source is, from confirmed to unsubstantiated.
Thinn's central finding is that no private key appears to have left Binance. Instead, Thinn argues, the attacker gained control of the company's own system for requesting signatures. In other words, it was the decision over what to sign that was hijacked — not the keys that perform the signing itself.
The reasoning lies in the pattern of the attack. Seventeen different Binance wallets across ten blockchains, using at least two different signature types and separate key stores, issued valid signatures to the attacker's addresses within about 30 minutes. A single stolen key could explain one wallet. A hijacked system for requesting signatures explains seventeen, Thinn writes. Binance's own explanation of what happened has, for its part, changed three times since the hack, without the company identifying a root cause.
On Ethereum, the decisive factor was EIP-7702, a feature that has been part of the protocol since May 2025 and lets an ordinary wallet hand off its behavior to a smart contract through a single signed authorization. At 20:20:59 UTC on October 29, the attacker sent fifty such authorizations in one transaction, likely because they could not know which nonce — a sequence number attached to every transaction — would be active the moment the wallet was hijacked.
Just over three minutes later, the wallet known as Binance 14 was drained of roughly $2.53 billion in a single transaction — two-thirds of everything taken on Ethereum. Binance's own deposit systems kept funneling customer funds into the same wallet, letting the attacker withdraw fresh amounts repeatedly through the evening, right up until 23:56. The wallet also held authorization to act on behalf of another Binance account, giving the attacker access to a further $823 million in USDC from it, according to Thinn.
Binance was not the first to regain control of the situation. Tether froze the address that received the bulk of the stolen funds at 21:01 — 86 minutes before Binance itself halted withdrawals. According to analytics firm Elliptic, $2.84 billion is confirmed frozen on-chain, 94 percent of it in stablecoins such as USDT and USDC. Neither bitcoin, XRP, solana nor NEAR can be frozen by an issuer, and nothing on those chains has been touched since the theft.
The attacker still holds between $3.2 billion and $3.3 billion that no issuer can touch. About $786 million in stablecoins was swapped into ether and tron at a steep discount in the window before the freezes landed. Buyers included professional market makers, who traded within minutes of the theft.
In the reconstruction, Thinn works through several claims that circulated in media coverage of the hack and finds they are either unsubstantiated or directly contradicted by the source material. That applies to claims that an AI agent was involved, that there was a flaw in the Ethereum protocol itself, and that there is a confirmed link to the same-day security breach at prediction market Polymarket. The same goes for the figure that Ripple froze $200 million, and the claim that the total frozen amount reached $5 billion. According to Thinn's review, the Ethereum protocol performed exactly as intended — a valid signature from the wallet's own key was misused, not a flaw in the network itself.
Analytics firms TRM Labs and Chainalysis assess, with high confidence, that the hacking group TraderTraitor is behind the attack, a group linked to North Korea. Elliptic is more cautious, calling the link probable rather than certain. The strongest public trace is that funds from the Binance hack and from the earlier Bitget hack in September converged in the same address, after several hops across blockchains. But only about $39,000 of the Binance funds have been traced there, against roughly $510,000 from Bitget — an address that could just as easily belong to a money launderer serving multiple clients, according to Thinn.
As of Thinn's latest review, no government had publicly attributed the attack to North Korea. That includes the US FBI, the Treasury's OFAC, and South Korean authorities.
Sources: Cointegrity
You have read what you can read for free. With an account you get unlimited access to all news and articles on kaupr.io — and become part of the network of investors, professionals and builders following onchain finance.