Binance has released its initial findings into the October 29, 2026, security incident, revealing that approximately $6.34 billion in digital assets were impacted. The cryptocurrency exchange says it will fully absorb the financial losses and has already replenished 98% of the affected assets.

Binance has published an initial security incident report outlining how attackers compromised its internal wallet infrastructure and exploited unauthorized transaction-signing capabilities to move billions of dollars in digital assets.

According to the exchange's November 3 update, the attack involved a sophisticated, multi-stage operation combining social engineering, malicious software, compromised developer environments, and an advanced blockchain transaction authorization mechanism.

The company confirmed that approximately $6.34 billion in digital assets were impacted, while around $2.85 billion had been frozen or intercepted as of the latest update. Binance also stated that it had set aside more than 100% of the funds required to cover the losses, assuring users that they would not bear the financial impact.

Binance Replenishes 98% of Affected Assets

In its public statement, Binance apologized to users, partners, and the wider cryptocurrency industry for the incident.

The exchange emphasized that protecting customer funds remains its primary responsibility. It confirmed that 98% of the impacted token assets had been replenished as of October 31, with the replenished balances verifiable through its official Proof of Reserves page.

Binance said it is purchasing the remaining assets, particularly those with lower liquidity, to complete the replenishment process.

The exchange also clarified that the financial impact of the stolen funds would be absorbed by Binance rather than passed on to customers.

How the October 29 Binance Attack Happened

Binance's initial investigation indicates that attackers gained unauthorized access to an internal wallet-signing service, allowing them to initiate transactions outside the exchange's normal withdrawal procedures.

The attack unfolded rapidly across several blockchain networks.

Between 20:05 and 20:09 UTC on October 29, five Binance hot wallets transferred approximately 233.46 million XRP to an attacker-controlled address.

Additional unauthorized transfers included:


  • Approximately 970,500 SOL from Binance hot wallets on Solana.

  • Approximately 44.2 million OP from Binance hot wallets on Optimism.

  • Approximately 18,270 BTC from a Binance hot wallet.

  • A final unauthorized transfer of approximately 2,961.9 ETH.

Binance received an internal alert about unusually large transactions and immediately launched an investigation.

However, the attackers had already established unauthorized on-chain permissions that allowed them to continue moving assets even after Binance suspended withdrawals.

Attackers Exploited Ethereum's EIP-7702 Authorization Mechanism

One of the most technically significant aspects of the incident involved Ethereum's EIP-7702 authorization mechanism.

EIP-7702 allows externally owned accounts to delegate certain execution capabilities to smart contracts without exposing their private keys.

According to Binance, the attackers abused this functionality to grant an attacker-controlled smart contract partial execution rights over a Binance hot wallet.

The attackers submitted 50 signing transactions to manipulate the account nonce and establish malicious delegation authorizations.

Once these permissions were established, the attackers could continue moving assets independently of Binance's regular withdrawal infrastructure.

This meant that suspending withdrawals and shutting down hot wallet services were not sufficient to immediately stop the unauthorized transactions.

Binance also faced additional technical challenges because the affected wallet used Multi-Party Computation (MPC) technology. Since MPC distributes signing responsibilities rather than relying on a single private key, revoking the malicious authorizations required a specialized technical procedure.

The final unauthorized transfer of 2,961.9 ETH was finalized on-chain at 23:56 UTC on October 29. Binance subsequently executed a new authorization from its Binance14 hot wallet to the zero address at 00:10 UTC on October 30, clearing the malicious EIP-7702 delegation code.

The exchange reported that no further unauthorized transfers were observed after this action.

Social Engineering and Malware Played a Key Role

Binance's investigation suggests that the incident was the result of a sophisticated, multi-stage campaign rather than a single security vulnerability.

The attackers reportedly combined several techniques, including:


  • Fake recruitment interviews targeting Binance employees.

  • Malicious software disguised as legitimate developer tools.

  • Compromised software packages and development environments.

  • Unauthorized access to internal AI tools.

  • Credential theft and endpoint compromise.

  • Exploitation of wallet transaction authorization mechanisms.

June 2026: Initial Supply Chain Compromise

The investigation identified an earlier supply chain attack involving a Wallet DevOps engineer.

In June, an engineer downloaded a tampered Homebrew installation while attempting to install a popular AI coding tool through a search engine.

Binance's security team detected the suspicious activity, replaced the affected device, and rotated related credentials.

However, the investigation indicates that the engineer's role and connections to other wallet infrastructure personnel had already been exposed to the attackers.

September 2026: Fake Recruitment Interviews

In September, another Binance software engineer was approached through a legitimate job-hunting platform by someone posing as a project director.

The attackers organized multiple interview rounds, including a live video interview with an individual claiming to represent human resources.

To establish credibility, the supposed recruiter shared social media profiles containing personal photographs and videos.

During a subsequent interview conducted through a popular messaging application, the engineer was instructed to download a software assignment containing a malicious code repository.

The malicious code executed during the setup process and initiated unauthorized activity on the engineer's work computer.

The malware reportedly used advanced obfuscation and evasion techniques, replacing a legitimate development tool component with a malicious version.

Binance stated that the malware was not detected by its endpoint security tools at the time and that the attackers attempted to conceal their activities and remove traces of the compromise.

October 20: Compromise of Internal AI Infrastructure

On October 20, the attackers reportedly leveraged the compromised engineer's computer and an internal AI tool to expand their access to other employees.

The investigation indicates that the attackers subsequently gained access to additional wallet infrastructure personnel, including a Wallet DevOps engineer whose computer contained a container deployment permission token.

This provided another opportunity to move deeper into Binance's internal systems.

October 29: Unauthorized Wallet Operations

On October 29, between 17:15 and 19:56 UTC, the attackers reportedly accessed another software engineer's computer, used stolen credentials, deployed a container, and executed a malicious script.

This ultimately enabled them to reach the internal wallet-signing operations involved in the incident.

FBI Attributes the Attack to North Korea

Binance's initial report also references information released by the Federal Bureau of Investigation (FBI), which attributes responsibility for the incident to the Democratic People's Republic of Korea (DPRK).

The attribution places the incident within the broader pattern of cyber operations targeting cryptocurrency companies and digital asset infrastructure.

Binance disclosed that its security team had detected and prevented 57 suspected North Korea-linked cyber threat cases throughout 2026.

These attempts reportedly involved fraudulent recruitment campaigns, malicious developer software, compromised browser extensions, fake video conferencing applications, and social engineering operations designed to steal credentials or deploy remote-access malware.

Binance Outlines Security Improvements

Following the incident, Binance said it had implemented several immediate security measures to contain the attack and reduce the possibility of similar incidents.

The measures include:


  • Rebuilding the affected wallet system in a new environment.

  • Rebuilding the compromised internal AI tool and strengthening its access controls.

  • Replacing affected employee devices.

  • Decommissioning credentials and access tokens associated with affected engineers.

  • Conducting enhanced security scans across employee devices.

  • Improving AI-based behavioural anomaly detection.

  • Strengthening wallet-service risk controls.

  • Cooperating with law enforcement agencies, blockchain intelligence firms, and industry partners to trace and freeze stolen assets.

The exchange also confirmed that the identified entry points used by the attackers had been closed and that affected systems had been rebuilt or replaced.

Independent Cybersecurity Review and Further Investments Planned

Binance says its investigation is still ongoing and that it is engaging independent cybersecurity firms to conduct a comprehensive review of the incident.

The independent assessment will examine the company's findings, evaluate the security weaknesses involved, and recommend additional measures to strengthen its infrastructure.

The exchange has also announced plans to increase investments in AI-powered security and prevention systems, particularly in endpoint protection, developer-environment security, and behavioural anomaly monitoring.

Additionally, Binance is working toward establishing a security research fund and targeted industry initiatives involving leading AI companies, blockchain participants, and cybersecurity firms.

The objective is to improve security across the broader digital asset ecosystem, particularly as attackers increasingly use sophisticated techniques to compromise developer tools and financial infrastructure.