Claims that the $6.3 billion Binance hack was an inside job are circulating widely on X as the exchange holds back its proof-of-reserves results until Monday, Nov. 2.
The doubts focus on the order of events. In its Oct. 30 update, Binance said it had covered about 80% of the stolen assets and was still buying the remaining 20%, and that it planned an initial proof-of-reserves snapshot within 12 hours, with results ready by Monday.
Why the timing draws scrutiny
A proof-of-reserves report is intended to show that an exchange holds enough assets to back every customer balance. Critics argue that running the check after the buyback obscures how large the gap was in the first place.
- Trader Financelancelot called the hack “totally an inside job,” questioning how an attacker could obtain the right authorizations from a near-limitless set of possibilities.
- Another user alleged that Binance “engineered a hack” to cover a liquidity crisis, arguing a single compromised laptop could not have signed transactions across ten blockchains in 20 minutes, and compared the situation to FTX before its collapse.
- Solana trader Ansem referenced the Oct. 10, 2025 liquidation crash, writing: “My trust in binance is gone. A new 10/10 is slowly loading.”
None of those claims are backed by hard evidence. Bitcoin.com News has previously reported that onchain sleuths questioned parts of Binance’s early explanation, which centered on a compromised laptop.
What the forensics show
Investigators point to an outside attacker while also explaining why the laptop account looked incomplete. Blockchain intelligence firm TRM Labs attributed the theft to North Korea’s Tradertraitor hacking group, writing: “We make this judgment with high confidence.”
TRM agreed that a phishing explanation “covers Ethereum and leaves the other chains unexplained.” Its assessment is that the attacker likely gained control of Binance’s hot wallet signing system, which could sign across chains.
The firm also found that preparation began at least 36 hours earlier with Tornado Cash withdrawals, and that the attacker rehearsed the code on test wallets before hitting Binance. Most of the funds left across ten chains in about 20 minutes from 20:05 UTC.
Binance has since moved beyond the laptop theory, saying it found additional breach points and “no evidence that wallet private keys were leaked.” Co-CEO Richard Teng has said only Binance’s own hot wallet was compromised and that customer funds were unaffected.
Not everyone shares TRM’s certainty on attribution. Crypto compliance firm Elliptic said North Korea-linked actors were likely responsible, but noted that “no government or law enforcement agency had yet confirmed attribution.”
Monday is the real test
Binance has said withdrawals should start returning in phases within about 34 hours, followed by the reserves report and a full technical post-mortem. Those disclosures will determine whether the inside-job talk fades or gains ground.
