A former employee kept the seed phrase after leaving, used it to launch the ASTEROID token, and together with three other wallets walked away with roughly $628,000. BNB Chain says it is pursuing legal action but has not named the individual or the venue.
BNB Chain said on Saturday that it is pursuing legal action against a former employee who allegedly kept the seed phrase from a company tutorial wallet after leaving the firm, then used it to launch a memecoin called ASTEROID and, together with three other addresses, walked away with roughly $628,000 in profit. The statement, posted on the network's official channel, did not identify the individual, the jurisdiction, the regulator or any court.
The wallet in question was created for an internal video tutorial demonstrating how to generate a token on BNB Smart Chain. Under normal deterministic wallet mechanics, a seed phrase is a master key: it derives every private key the wallet will ever hold, and wiping one private key from an employee's device does nothing to a copy of the seed already written down. BNB Chain has not disclosed when the employee departed, how long the seed remained accessible, or when it discovered the retained access.
On-chain analytics account Lookonchain traced the token to four newly created wallets that spent roughly $10,000 to buy 796.7 million of the one-billion ASTEROID supply, or 79.67 per cent of the total, within minutes of the 1 August launch. Those wallets then sold 718.8 million ASTEROID for 1,103 BNB, worth about $638,000. The token's market cap peaked near $10 million within four hours before collapsing, and the profit attributed to the operator came to roughly $628,000. BNB Chain's own statement is here:
Changpeng Zhao, the Binance founder whose exchange is closely associated with the BNB brand, reposted the network's statement on X and called the former employee "basically a scammer," telling users to "stay SAFU." His characterisation is an allegation, not a court finding. Neither BNB Chain nor Zhao named the person, and Lookonchain's on-chain attribution links wallet activity, not a legal identity.
The failure is procedural, not cryptographic. A seed phrase, once written down or photographed, cannot be revoked by wiping a device; the only defence is not letting the seed leave the boundary in the first place. Tutorial wallets, demo environments and staged transactions are exactly the kind of low-priority infrastructure that rarely gets reviewed against personnel offboarding. In this case a demo wallet that was probably never intended to hold value provided a live address the ex-employee could rebuild control over long after leaving. Any organisation that produces on-chain demo content faces the same exposure: every recorded seed is now a persistent liability against every staffer who ever handled it, whether or not they still work there.
Binance suspended a different employee last year after allegations of token front-running from a previous role at BNB Chain. That case involved knowledge, not custody; this one involves custody of the underlying key. BNB Chain's Saturday statement did not say whether the two matters involve the same person. It also did not include a named agency, a case number, or any confirmation of a formal complaint — those would come with the first regulatory or court filing. Public statements from crypto companies about pending litigation without a matching court record are common; they signal intent and reserve reputational rights, but they are not themselves enforcement.
Recovery, if there is any, depends on where the 1,103 BNB ended up. If the funds reach identifiable exchange accounts, subpoena requests can compel identity disclosure. If they move through mixers or peer-to-peer trades, the trail thins quickly. At current BNB prices, 1,103 tokens represent roughly $652,000, so the destination wallets are still large enough for on-chain analysts to track. BNB Chain has not announced a freeze, a recovery mechanism, or any repayment for the buyers who took the other side of the trade. Multiple derivative tokens now share the ASTEROID name, which makes any price reaction hard to attribute.
The tutorial-wallet story lands at an awkward moment for exchange-adjacent infrastructure teams. Galaxy is flagging a third Coldcard sweep that has now cost holders 1,367 bitcoin, and Ctrl Wallet just went export-only six weeks after its Cardano exploit, and both are self-custody vendors failing on key material they were supposed to protect. A corporate infrastructure operator failing on the same task, on a wallet its own tutorial videos publicised, is a different kind of embarrassment. The dollar figure is small. The failure mode is not.
