Binance hot wallet Binance14 compromised via signing service

Following a 2026 security breach where an attacker gained control of a Binance hot wallet using valid signatures, researchers at hwtn.io analyzed the self-reported intrusion vector and traced the movement of stolen assets on the Ethereum blockchain. The author reports that pre-theft gas money was funneled through Tornado Cash, while post-theft assets were rapidly split, sent to fresh addresses, and parked without hitting known mixers within the observed two-hop window. The analysis notes that Binance's account of the intrusion relies on self-reported events, with only a pyenv file size check verifiable against public source code. Open article →