BNB Chain, the blockchain network behind the BNB cryptocurrency, confirmed on Saturday that it is pursuing legal action against a former employee who allegedly retained access to a wallet seed phrase after leaving the company and used it to deploy an unauthorized meme token on the network.

The company published the disclosure on X. Its statement said the wallet was originally created by the former employee for a video tutorial, as part of a demonstration of how to launch a token on BNB Chain. The individual later departed. According to BNB Chain, they did not leave the seed phrase behind.

"The individual retained unauthorised access to the associated seed phrase after their departure and used it to generate a new private key," the company said.

The token allegedly deployed through that wallet is called Asteroid Shiba, ticker ASTEROID. The existing Asteroid Shiba project publicly stated that the version launched from the tutorial wallet was a copycat and denied any connection to it. BNB Chain denied any involvement in the token.

"BNB Chain did not create, authorise, promote or participate in the creation of this token and has no control over the token or wallet address. These are not affiliated with or endorsed by BNB Chain," the company said in its X post.

How a tutorial wallet became a liability

The wallet at the center of this case was created in February 2025, when a BNB Chain employee used it to demonstrate how to deploy a token on the Four.Meme launchpad. The demonstration token was called TST. The walkthrough was meant to be instructional. The wallet was not meant to carry any lasting significance.

It did not stay that way. Traders who watched the video found the TST ticker briefly visible on screen, and speculation drove TST's market capitalization above $50 million. Binance founder Changpeng "CZ" Zhao publicly clarified that TST held no official status as a network token, and the tutorial video was removed from public platforms. BNB Chain said at the time that it had deleted the private key for the creator address, which held 0.13% of TST's supply.

That step addressed one derived key but left the root intact.

The underlying cryptographic standard here is BIP39, which converts a sequence of 12 to 24 words into a deterministic set of keys. The same phrase regenerates the same private keys every time, on any compatible wallet software, with no central server to disable and no revocation mechanism to trigger. Anyone who holds those words retains permanent access to every key that phrase can produce. Deleting a key file removes one instance of access. It does not touch the phrase.

BNB Chain's statement confirmed that the former employee still had the phrase. Using it, the individual allegedly generated a new private key from the same root and reactivated control of the original wallet address. BNB Chain's own user guidance advises against sharing private keys or seed phrases with anyone. That guidance did not appear to extend to internal protocols for managing demonstration wallets after an employee's departure.

What the on-chain data shows

Blockchain analytics firm Lookonchain published an on-chain analysis alleging that four newly created wallets spent approximately $10,000 to acquire 796.7 million ASTEROID tokens. That purchase amounted to 79.67% of the stated one-billion token supply. Within four hours of the launch, ASTEROID reached a $10 million market capitalization and recorded over $20.5 million in cumulative trading volume.

Those four wallets then sold 718.8 million tokens for approximately 1,103 BNB, worth roughly $638,000 at the time of sale. Lookonchain estimated the net profit at approximately $628,000 and published all four wallet addresses on BscScan for public review.

BNB Chain's statement does not confirm those figures. Lookonchain's analysis documents wallet activity, not the legal identity of the person behind an address. The attribution of those wallets to the former employee is an allegation, supported by BNB Chain's own statement and Lookonchain's on-chain tracing but not independently verified.

Within 20 minutes of BNB Chain's public announcement disavowing the token, ASTEROID's price fell 52% and the market capitalization dropped below $3 million. Retail buyers who entered during the run absorbed those losses.

Zhao reposted BNB Chain's statement on X, described the former employee as "basically a scammer," and told users to "Stay SAFU." His characterization is an allegation, not a legal determination.

BNB Chain said it is cooperating with relevant authorities but named neither an agency nor a jurisdiction. The company has not said whether the action is civil or criminal, what remedy it seeks, or who the former employee is.

The legal difficulty is structural. Unauthorized access statutes, including the Computer Fraud and Abuse Act in the United States, were drafted around passwords and server-side credentials that an organization can revoke centrally. The Supreme Court's Van Buren ruling in 2021 narrowed the CFAA's scope: the statute applies to accessing areas that are off-limits to a user, not to accessing a computer for an unauthorized purpose. Retaining a memorized seed phrase and reusing a previously authorized wallet address is not straightforward code-based hacking. No court has yet determined whether it constitutes unauthorized access under any existing statute.

BNB Chain's lawyers may need to rely on alternative theories. Misappropriation of trade secrets or breach of fiduciary duty are possible avenues, though which holds depends on the jurisdiction where proceedings are filed, a detail BNB Chain has not disclosed. The company also has not said when the employee departed or how long the seed phrase remained in their possession.

If courts rule that retaining a seed phrase after separation constitutes unauthorized access, that would give blockchain companies a legal tool for post-employment conduct that does not currently exist. No such ruling has been made.

A pattern across the Binance ecosystem

The ASTEROID case is the third insider-linked token incident to reach the broader Binance ecosystem since early 2025.

In March 2025, a Binance Wallet team member, publicly identified on X as Freddie Ng, former BNB Chain operations manager, though Binance did not officially confirm that identification, allegedly used non-public information from a prior BNB Chain role to front-run a token generation event. He allegedly bought approximately $6,200 worth of UUU tokens across multiple linked wallets before any public announcement, then sold into the launch for profits exceeding $113,000. Binance suspended the employee and filed legal action; whistleblowers who reported the conduct shared a $100,000 reward.

In December 2025, a different Binance employee used the official @BinanceFutures account, which had more than 523,000 followers, to post promotional content about a token the employee had already deployed on-chain. The token, called "Year of Yellow Fruit," peaked at a $6 million market cap. Binance suspended that employee and cooperated with law enforcement.

The ASTEROID case required neither privileged information nor control of a verified account. It required only a string of words the individual could have memorized before their last day and carried out with no digital trace left on any company system.

At the time of publication, BNB was trading at $583, a 0.2% decline over the prior 24 hours, with a market capitalization near $77.55 billion, per CoinMarketCap. BNB remains 55% below its all-time high of $1,370.55, set in October 2025.

BNB Chain has not confirmed whether other tutorial wallets created for similar demonstration purposes are under security review. On July 8, the company published its H2 2026 technical roadmap, outlining plans to develop network infrastructure for artificial intelligence deployment and tokenized real-world asset issuance, with banks and institutional asset managers named as its target adopters.

BitMEX to Shut Down Exchange Operations by September 2026 | HODL FM NEWS
BitMEX exchangewill close by September 23, 2026, urging users to withdraw funds as risk limits and force closures begin ahead of the shutdown date.
hodl-post-imageHODL FM News: The Wildest Ride in the Crypto MarketGunel Ismayilova
hodl-post-image

Disclaimer: All materials on this site are for informational purposes only. None of the material should be interpreted as investment advice. Please note that, despite the nature of much of the material created and hosted on this website, HODL FM operates as a media and informational platform, not a provider of financial advisory services. The opinions of authors and other contributors are their own and should not be taken as financial advice. If you require advice, HODL FM strongly recommends contacting a qualified industry professional.