Key Takeaways
- Binance says its proof of reserves results arrive Nov. 2, after it buys back the last 20% of stolen assets.
- Several post calling the $6.3B Binance hack an inside job have gained traction on X.
- Truthers argue that a Nov. 2 snapshot taken after the buyback can’t reveal how big the hole really was.
Skeptics Question the Timing of Monday’s Audit
The doubts center on the order of events, as in its Oct. 30 update, Binance said it had covered about 80% of the stolen assets and was still buying the remaining 20%. It planned an initial proof-of-reserves snapshot within 12 hours, with results ready by Monday, Nov. 2.
A proof-of-reserves report is meant to show that an exchange holds enough assets to back every customer balance, but critics argue that running it after the buyback hides how big the gap was in the first place.
Subsequently, popular trader Financelancelot called the hack “totally an inside job,” questioning how an attacker could land the right authorizations from limitless possibilities.
At the same time, another individual alleged that Binance “engineered a hack” to cover a liquidity crisis, arguing that a single compromised laptop could not have signed transactions across ten blockchains in 20 minutes, and compared the situation to FTX before its collapse.
Lastly, noted Solana trader Ansem referenced the Oct. 10, 2025 liquidation crash, before stating:
My trust in binance is gone. A new 10/10 is slowly loading.
However, it needs to be made clear that none of the aforementioned claims are backed by hard evidence, and Bitcoin.com News previously reported on how onchain sleuths questioned parts of Binance’s early explanation, which focused on a compromised laptop.
What the Forensics Actually Show
Investigators point to an outside attacker, while also showing why the laptop story looked incomplete. Blockchain intelligence firm TRM Labs attributed the theft to North Korea’s Tradertraitor hacking group, writing: “We make this judgment with high confidence.”
TRM agreed that a phishing explanation “covers Ethereum and leaves the other chains unexplained.” Its assessment is that the attacker likely gained control of Binance’s hot wallet signing system, which could sign across chains.
TRM also found that preparation began at least 36 hours earlier with Tornado Cash withdrawals, and that the attacker rehearsed the code on test wallets before hitting Binance. Most of the funds left across ten chains in about 20 minutes from 20:05 UTC.
Binance has since moved beyond the laptop theory and said it found additional breach points and “no evidence that wallet private keys were leaked.” Co-CEO Richard Teng has said only Binance’s own hot wallet was compromised and customer funds were unaffected.
Not everyone shares TRM’s certainty on attribution, with crypto compliance firm Elliptic saying North Korea-linked actors were likely responsible, but “no government or law enforcement agency had yet confirmed attribution.”
Monday Is the Real Test
Binance has said withdrawals should start returning in phases within about 34 hours, followed by the reserves report and a full technical post-mortem. Those disclosures will decide whether the inside job talk fades or gains ground.
