The Binance hack: why tracing crypto is only the beginning

365 ALTERAM analysis

The investigation must explain more than where the money went

A major cryptocurrency theft demands answers that a transaction chart alone cannot provide. Who could authorise the transfers? Which controls operated or failed? What remains recoverable? And how strong is the evidence connecting the activity to particular people? These questions matter to affected businesses, customers, insurers and legal teams. The reported Binance hack makes independent forensic scrutiny essential to a reliable account of the loss and responsibility.

Public record

Public record: what the initial disclosures establish

In its 30 October 2026 update, Binance estimated the incident's impact at approximately US$6.3 billion and said around US$3 billion had been frozen. Its initial investigation suggested that a compromised DevOps engineer's laptop enabled access to a service container and unauthorised withdrawals. Binance reported finding no evidence of leaked wallet private keys. It announced a temporary suspension of deposits and withdrawals, revocation of the affected address authorisation, and cooperation with law enforcement and blockchain specialists. [1]

Binance said its SAFU emergency fund and company funds would cover losses, and promised a technical post-mortem and updated proof of reserves. These are company statements; they do not independently establish completed reimbursement or the final cause. [1]

TRM Labs separately reported approximately US$6.36 billion leaving Binance-attributed wallets across ten blockchains on 29 October, most within about twenty minutes beginning at 20:05 UTC. It described Ethereum activity involving EIP-7702 delegation and transfers on other networks, assessing that signing infrastructure had been compromised. TRM attributed the attack to North Korea's TraderTraitor group with high confidence. These are the firm's published findings and assessment, rather than a judicial determination. [2]

This incident should be distinguished from Binance's May 2019 disclosure of a 7,000 BTC hot-wallet theft, and the October 2022 BSC Token Hub bridge exploit involving two million BNB. The bridge and exchange incidents concern different technical systems. [3][4]

365 ALTERAM analysis

Reconstruct how transactions became authorised

The first forensic task is to connect transaction execution with the systems that approved it. An Ethereum delegation allows an account to execute designated code following signed authorisation; this is part of EIP-7702's documented operation. Its use in an incident does not, by itself, establish a defect in Ethereum. [5]

Similarly, a valid signature does not establish that an authorised employee intended the transfer. Investigators should compare available endpoint artefacts, cloud access records, service identities, signing requests, approval policies and deployment changes. Align those records with blockchain events, documenting clock differences and missing logs. Access to a signing service and extraction of a private key are different hypotheses requiring different evidence.

The reference to an engineer's laptop must not become a premature accusation against its owner. A compromised device can be an entry point without proving the employee's knowledge or participation. A sound review tests that distinction and reports evidence that supports, contradicts or leaves either explanation unresolved.

365 ALTERAM analysis

Preserve evidence while containment proceeds

NIST's forensic guidance stresses integrity, documented handling and the vulnerability of volatile data to loss. Applied here, an authorised preservation plan should identify relevant devices, short-lived workloads, identity logs and signing records alongside public transaction data. Record collection times, methods and integrity checks, and document changes made during containment. Evidence preservation must be coordinated with urgent protective action. [6]

For blockchain exhibits, retain network identifiers, transaction hashes, block references and the source of each address label. Record tool versions and analytical assumptions. Another qualified reviewer should be able to follow the reasoning, including where records are unavailable.

365 ALTERAM analysis

Reconcile the loss and identify realistic recovery routes

A defensible loss schedule separates the original unauthorised outflows, subsequent transfers, frozen balances, returned assets and customer compensation. Counting successive transfers of the same assets as fresh losses inflates the total. Dollar estimates also need a stated valuation time and price source.

Frozen assets are not necessarily returned assets. A trace may identify an exchange, issuer or other intermediary able to assist, but recovery depends on control, cooperation and applicable procedures. Reconcile public wallet movements with available internal ledgers and customer liabilities; a public address balance alone cannot settle an individual customer's exposure.

365 ALTERAM can prepare a transaction-level evidence schedule and a prioritised list of preservation or information requests for counsel. Compulsory disclosure, freezing and recovery measures remain matters for the appropriately authorised parties and relevant jurisdictions.

365 ALTERAM analysis

Test attribution and deliver an independent account

TRM's attribution is an important investigative lead. Independent review should distinguish reproducible observations from intelligence that has not been disclosed. Wallet clustering, behavioural similarities and infrastructure links need their assumptions tested. Repeated reporting of one attribution is not independent corroboration; an intermediary receiving assets is not automatically a knowing accomplice.

Under an agreed mandate and subject to conflict checks, 365 ALTERAM can combine blockchain reconstruction, digital evidence review and financial reconciliation with appropriately qualified specialists. Deliverables can include an incident chronology, a provenance register, a loss schedule and a source-indexed report explaining the strength and limits of each conclusion.

That work can support affected businesses and their counsel, or an independent review for a party facing allegations. It may confirm the initial account, expose a material error or leave questions unresolved. No recovery, identity attribution or legal outcome can be guaranteed. A confidential assessment begins with a neutral case summary; sensitive evidence should follow through an agreed channel, and private keys, seed phrases and passwords should never be sent in an initial enquiry.