The unresolved question in Binance’s $6.3 billion cryptocurrency breach is who controlled its transaction approvals, not whether its wallets signed away the money. That gap has become the basis for online allegations that the exchange staged the attack to conceal financial losses.
Allegations surface that Binance manufactured the incident to stop a bank run and disguise missing customer assets. The posts cite transfers across different blockchains, unusually structured Bitcoin movements, and steeply discounted token swaps.
It is worth noting that they offer no financial records, internal communications, or independently corroborated evidence of a deliberate corporate operation.
Blockchain intelligence firm TRM Labs traced approximately $6.36 billion leaving Binance-associated wallets across 10 networks on October 29, mostly within about 20 minutes. The transactions bore valid signatures.
Sponsored · Silver47 Exploration Inc.
On Ethereum, investigators identified 50 pre-signed authorizations using the EIP-7702 delegation mechanism, enabling attacker-controlled software to sweep a hot wallet.
TRM assessed that the exchange’s hot-wallet signing infrastructure had been compromised and attributed the theft with high confidence to North Korea’s TraderTraitor group.
Binance initially pointed to a compromised DevOps engineer’s laptop. Its October 30 update acknowledged additional breach points while saying investigators had found no evidence that wallet private keys were leaked.
The online theory also highlights 18,270 BTC divided into round-sized transfers and approximately $325 million in USDT swapped for ether at a discount exceeding 10%. TRM described the Bitcoin movements as a peel chain, a technique that complicates tracing, while rapid conversion of freezeable stablecoins offered a plausible reason to accept unfavorable execution prices.
Earlier, The Deep Dive reported the estimated $6.3 billion impact and the withdrawal suspension. A subsequent report, citing Bitquery, found unauthorized Ethereum transfers continuing until 23:56 UTC, after Binance had suspended customer withdrawals. Bitquery said the malicious authorization was revoked at 00:10 UTC on October 30.
Neither finding demonstrates an intentional shutdown designed to prevent customers from accessing insolvent accounts.
Binance says it allocated more than $6.34 billion of company funds to cover losses, including $5 billion already held in affected tokens. It separately reports approximately $3 billion frozen with help from industry partners. Frozen assets have not necessarily been returned.
The crypto platform plans to publish updated proof of reserves on November 2 and a full technical report later.
