Co-CEO Richard Teng said Oct. 30 the attack struck Binance’s own hot wallet while most customer assets stayed in cold storage until withdrawal. Binance reported Tuesday that intruders used an internal wallet-signing service to move funds outside normal withdrawals. CertiK analyst Jonathan Riss said