Casablanca – Binance said it has replenished 98% of the assets affected by a major security incident on October 29, involving approximately $6.34 billion in digital assets. The company said it would absorb the financial losses rather than pass them on to users, adding that it had set aside more than the amount needed to cover the incident.

As of October 31, the exchange had restored 98% of the affected token assets, which users can verify through its Proof of Reserves page. Binance said it was purchasing the remaining less liquid assets.

The company also reported that authorities and industry partners had frozen or intercepted approximately $2.85 billion in digital assets, subject to reconciliation and market price fluctuations.

In its initial investigation report, Binance said attackers gained unauthorized access to an internal wallet signing service, allowing them to initiate transactions outside the normal withdrawal process.

Between 20:05 and 20:09 UTC, five Binance hot wallets transferred 233.46 million XRP to an attacker-controlled address. Other wallets sent approximately 970,500 SOL and 44.2 million OP, followed by a transfer of 18,270 BTC.

The attackers also exploited Ethereum’s EIP-7702 authorization mechanism to grant a malicious smart contract partial execution rights over a Binance hot wallet. They submitted 50 signing transactions to establish unauthorized permissions, allowing them to move assets independently of Binance’s normal withdrawal infrastructure.

Binance suspended withdrawals and worked with partners to freeze affected tokens. However, the exchange said these measures could not automatically revoke existing on-chain authorizations. Its Multi-Party Computation wallet system also required a specialized procedure to remove the malicious permissions.

The final unauthorized transfer involved 2,961.9 ETH and finalized at 23:56 UTC. Binance executed a new authorization at 00:10 UTC on October 30 to clear the malicious delegation code.

Read also: Morocco’s Crypto Inflows Reach $14.6 Billion Amid Push for Regulation

The investigation traced the attack’s preparation to several months earlier. In June, an engineer downloaded a tampered Homebrew installation while trying to install an AI coding tool. Although Binance detected the anomaly, replaced the device, and rotated credentials, the attackers had already gained exposure to the engineer’s role and colleagues.

In September, another engineer fell victim to a fake recruitment process involving video interviews and a malicious coding assignment. The downloaded repository installed malware that compromised his work computer.

By October 20, attackers had used the compromised device and an internal AI tool to gain access to other wallet engineers. On October 29, they used stolen credentials and a container deployment permission token to reach wallet signing operations.

Binance said its security team had detected and prevented 57 suspected North Korea-linked cyber threat cases throughout 2026.

Following the incident, the exchange rebuilt affected wallet systems and its internal AI tool, replaced compromised devices, revoked related credentials, and strengthened wallet controls and AI-based threat detection.

It is also engaging independent cybersecurity firms to review the incident and plans to invest further in AI security research and industry cooperation.

The investigation remains ongoing, with Binance saying it will continue sharing findings while keeping some technical details confidential.