John_BNB

On 29 October 2026, Binance experienced a serious and highly sophisticated security incident. This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry.
Our first responsibility is to protect users. Binance will absorb the financial impact of the stolen funds, not our users. We have already set aside more than 100% of the funds required to cover the loss. As of 31 October 2026, 98% of the impacted token assets have been replenished and are verifiable on our Proof of Reserves page. We are in the process of purchasing the outstanding, more illiquid assets.
Approximately USD 6.34 billion in digital assets were impacted by the incident. As of this update, approximately USD 2.85 billion in digital assets have been frozen or intercepted, subject to reconciliation and market price volatility.
We have taken immediate action to contain the incident and strengthen the systems involved. The entry points identified as having been used in the attack have been closed. Systems touched in the attack path have been rebuilt or replaced. We have also implemented tighter device controls, enhanced wallet-service risk controls and expanded AI-based behavioural anomaly detection.
This is our initial report. It covers what we know today and what we have already improved. The investigation remains ongoing and our findings will be subject to further independent review. Some technical details will remain confidential to prevent malicious actors from using them to plan attacks. We are engaging independent security firms for further review.
The latest information released by the Federal Bureau of Investigation indicates that the Democratic People’s Republic of Korea is responsible for this incident.
We are sharing this initial report because security improves when the industry learns together.
What happened on 29 October
The attack unfolded quickly across several networks.
The attacker exploited unauthorized access to an internal wallet signing service to initiate transactions outside the normal withdrawal process.
Between 20:05 UTC and 20:09 UTC, five Binance hot wallets sent 233.46 million XRP to an attacker-controlled address.
Binance hot wallets on Solana and Optimism sent approximately 970,500 SOL and 44.2 million OP to attacker-controlled addresses.
Binance then received an internal alert regarding large-volume transfers and immediately began investigating.
Binance hot wallet sent 18,270 BTC to an attacker-controlled address.
The attacker then used the signing service to exploit Ethereum’s EIP-7702 authorization mechanism. EIP-7702 allows an account to delegate certain execution rights to a smart contract without exposing the private key. In this case, the attacker used that mechanism to give an attacker-controlled smart contract partial execution rights over a Binance hot wallet.
Binance immediately initiated multiple containment measures, including suspending withdrawals to restrict further outflows, coordinating with partners to freeze affected tokens, and taking steps to revoke unauthorized permissions. These efforts froze a total of $2.85 billion in assets.
However, suspending withdrawals alone could not stop all unauthorized asset movements. The malicious EIP-7702 authorizations existed on-chain and operated independently of Binance’s normal withdrawal infrastructure. The attackers submitted 50 signing transactions to manipulate the account nonce and establish malicious delegation authorizations. Once established, these authorizations enabled the attackers to continue moving assets independently of Binance's normal withdrawal infrastructure. Binance needed additional transactions to revoke these on-chain authorizations.
The containment process involved additional technical complexities. Because the hot wallet used Multi-Party Computation (MPC), there was no single private key that could be used to immediately revoke the malicious EIP-7702 authorizations. The team therefore developed and executed a specialized procedure to revoke these authorizations, which required additional time. Furthermore, suspending withdrawals and shutting down hot wallet services did not automatically invalidate existing on-chain authorizations.
These challenges extended the time required to fully contain the unauthorized asset movements. We are reviewing the incident response process, signing policy coverage, hot wallet controls and identifying opportunities to further strengthen our ability to respond rapidly to threats in the future.
The final unauthorized transfer of 2,961.9 ETH finalized on-chain at 23:56 UTC. The transaction had previously been broadcast and remained pending before subsequently finalizing. No further unauthorized transfers were observed after.
At 00:10 UTC on 30 October 2026, Binance executed a new authorization from the Binance14 hot wallet to the zero address, clearing the EIP-7702 delegation code.
Attack Preparation
Our current investigation indicates that this was a sophisticated, multi-stage campaign. It was not a single isolated breach or a simple phishing incident. The attackers combined a range of techniques, including social engineering by fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise, and an advanced transaction-authorization method.
June 2026 — Supply chain attack. Engineer A from Wallet DevOps downloaded a tampered Homebrew installation in order to install a popular AI coding tool after searching for it on a search engine. Our security team detected the anomaly, replaced the device, and rotated all related credentials as a proactive security action. However, Engineer A’s role and his related colleagues on our wallet infrastructure team was exposed to the hacker.Throughout 2026, Binance's security team detected and prevented 57 suspected North Korea-linked cyber threat cases. These attempts reflect the persistent threat posed by state-sponsored actors targeting the cryptocurrency industry. The techniques include fraudulent job interviews, malicious software disguised as popular developer tools, compromised software packages and browser extensions, fake video conferencing applications, and social engineering campaigns designed to steal credentials or deploy remote access malware.September — social engineering. Software Engineer B was contacted through a legitimate job-hunting platform by an individual posing as a Project Director. Software Engineer B had a profile on the platform that referenced his experience at Binance. The purported Project Director arranged a first-round interview with a HR representative, followed by a second-round interview with an individual claiming to be the CEO of a fictitious company.In the first round, the purported HR representative conducted a live video interview with Software Engineer B. The interviewer shared a social media account with him, including personal photos and videos posted on the platform, in order to build trust. This was more advanced and deceptive than previously seen social engineering approaches.The second interview was conducted in a popular social chat app, near the end of the interview, Engineer B was instructed to download an “assignment” containing a malicious code repository onto his work computer. The repository contained malicious code that executed during the setup process, initiating a series of unauthorized activities.The malware employed sophisticated obfuscation and evasion techniques, including replacing a legitimate development tool component with a malicious version to execute commands and establish communication with an attacker-controlled external server. The 0-day malware was not detected by the endpoint security protection tools at the time. The attacker also took steps to conceal the malicious activity and remove traces of the compromise, making detection and subsequent investigation more challenging.The script executed the below steps by applying obfuscation techniques to evade security detection.
CREATE /opt/homebrew/Cellar/pyenv/2.8.0/libexec/pyenv_
MODIFY pyenv_ → 3,414 B
DELETE .../libexec/pyenv (3,344 B) ← remove the valid pyenv
RENAME pyenv_ → pyenv (3,414 B) ← replace it with a malicious version
DELETE /opt/homebrew/bin/pyenv (3,414 B)
ln (create a new symlink) + spawn zsh
20 October — use of an internal AI tool as a springboard. The attacker leveraged the compromised computer of engineer B and used an internal AI tool to gain control over the Wallet DevOps Engineer A and another Wallet Software Engineer C. The attacker soon discovered Wallet DevOps Engineer A had a container deployment permission token on his computer.29 October — reach into wallet signing operations. On 29 October between 17:15 and 19:56, the attacker logged onto Software Engineer C’s computer, used the credentials stolen from Wallet DevOps Engineer A, deployed a container, and triggered a malicious script to launch the attack.
What we have done
As of Nov 3, 2026, we have taken the following actions:
Rebuilt the affected wallet system in a new environment.Rebuilt the affected internal AI tool and access controls.Replaced affected devices.Decommissioned credentials and tokens related to affected engineers.Completed enhanced security scans across all employee devices.Enhanced AI-based behavioural anomaly detection.Strengthened wallet-service risk controls.Worked with law enforcement, blockchain intelligence firms and industry partners to trace and freeze affected assets.
We will continue to strengthen our measures as the investigation progresses. There are a number of security measures we have implemented and are implementing that will remain private to prevent malicious actors from compromising our security.
Further actions
We are taking the following steps immediately.
Independent cybersecurity review
We are engaging independent third-party cybersecurity experts to conduct a comprehensive review of the incident, validate our findings and recommend additional measures. The scope and findings of that review will inform our continuing remediation work.Expanded investment in AI security and prevention
We are increasing investment in AI-enabled detection, endpoint protection, developer-environment security and behavioural anomaly monitoring.Security research fund and industry initiatives
We are working on establishing a security research fund and targeted initiatives with leading AI companies, industry participants and security firms focused on AI security in blockchain environments.
We will continue to proactively share information as and when we have it.
Source: Binance official x account (@binance)
#safu #BinanceIncidentReport #BinanceReopensWithdrawalsForMoreAssets

Is my money safe on Binance? It's an important question for anyone investing or trading cryptocurrency.
Binance uses multiple safeguards, including Proof of Reserves (PoR), the Secure Asset Fund for Users (SAFU), AI-powered risk detection, and account security features.
However, no cryptocurrency exchange is entirely risk-free. Understanding how these protections work—and their limitations—can help you make informed decisions about your assets.
On October 30, 2026, Binance reported a major security incident with an estimated financial impact of approximately $6.3 billion. The exchange stated that it would cover all losses using SAFU and company funds. This incident highlights the importance of understanding both exchange security measures and financial protection mechanisms.
How Does Binance Protect Customer Funds?
Binance uses multiple layers of security to reduce risks associated with cyberattacks, fraud, and unauthorized transactions.
Key safeguards include:
Wallet security: Hot wallets support transactions, while cold wallets help keep assets offline.Account protection: Two-factor authentication (2FA), passkeys where supported, and other verification methods help prevent unauthorized access.Withdrawal controls: Security checks help identify suspicious transfers.AI-powered monitoring: Automated systems analyze transactions and account behavior to detect potential fraud.Proof of Reserves: Cryptographic verification helps users check whether their balances are included in published reserve reports.SAFU fund: An emergency reserve designed to cover eligible losses from certain security incidents.
These measures reduce risk, but users should also secure their accounts, avoid phishing links, and never share passwords or authentication codes.
What Is Binance's Proof of Reserves and How Does It Work?
Proof of Reserves (PoR) is a verification system designed to help demonstrate whether an exchange holds sufficient cryptocurrency assets to back its customers' reported balances.
Binance uses cryptographic techniques, including Merkle trees and zero-knowledge proofs, to support verification while protecting individual account information.
Users can check the official Binance Proof of Reserves page.
How Does Proof of Reserves Work?
The process generally involves three steps:
Record customer balances: Customer balances are included in a snapshot used to calculate reported liabilities.Verify reserves: The exchange provides information about cryptocurrency assets held in its wallets.Enable verification: Cryptographic proofs allow users to check whether their balances were included in the published report.
Why Is Proof of Reserves Important?
PoR improves transparency and helps users verify their account inclusion instead of relying entirely on an exchange's statements.
However, Proof of Reserves is not a complete financial audit or a guarantee against insolvency. A snapshot reflects a particular point in time, and its reliability depends on the assets, liabilities, and verification methods covered.
Users should review the report's date, scope, and methodology when assessing an exchange's financial position.
What Is Binance's SAFU Fund and How Does It Protect Users?
The Secure Asset Fund for Users (SAFU) is an emergency reserve established by Binance in July 2018 to help protect users against eligible losses from certain security incidents.
Binance originally funded SAFU by allocating a portion of its trading fees. In February 2026, Binance reported that the fund held approximately $1 billion in cryptocurrency assets, although its market value can fluctuate.
How Does SAFU Work?
SAFU provides a financial resource that Binance can use to compensate eligible users following qualifying security incidents.
However, it is not unlimited insurance, and compensation is not automatically guaranteed for every type of loss.
What Happened During the 2019 Binance Hack?
In May 2019, Binance reported a security breach involving approximately 7,000 BTC, worth around $40 million at the time. The exchange committed to covering the losses through SAFU, ensuring that affected users would not bear the financial impact.
SAFU vs. Proof of Reserves
In simple terms, Proof of Reserves helps users assess asset backing, while SAFU provides financial resources for eligible losses.
How Does Binance Use AI and Security Technology to Protect User Assets?
Cryptocurrency exchanges face threats such as phishing, account takeovers, fraudulent transactions, and sophisticated scams.
AI can help security teams analyze large amounts of activity and identify suspicious patterns.
Binance has reported using more than 100 dedicated AI models in its financial crime prevention systems. According to the company, its AI-assisted risk systems helped protect more than eight million users and prevent approximately $4.6 billion in potential losses during the first half of 2026.
AI and security technology support several functions:
Fraud detection: Identifying unusual transaction patterns and potentially fraudulent behavior.Real-time monitoring: Flagging suspicious activity for additional checks.Identity verification: Helping detect suspicious documents and possible identity fraud.Scam detection: Identifying patterns associated with phishing and fraudulent activity.Incident response: Supporting investigations alongside security professionals.
AI can improve threat detection, but it cannot prevent every attack. Users should continue practicing good security habits.
What Happens to My Assets if a Crypto Exchange Becomes Insolvent?
Exchange insolvency occurs when a business cannot meet its financial obligations or its liabilities exceed its assets, depending on the applicable legal framework.
If a cryptocurrency exchange becomes insolvent, users may experience withdrawal restrictions, delays, or a formal process for recovering assets.
Are Customer Assets Automatically Returned?
Not necessarily. The outcome depends on the exchange's financial condition, custody arrangements, applicable laws, and contractual terms.
Proof of Reserves provides useful information about asset backing at a particular time, but it does not guarantee immediate withdrawals or full recovery in every insolvency scenario.
How Can You Reduce Exchange Risk?
Consider these practical steps:
Keep only the cryptocurrency you need for trading on an exchange.Consider self-custody for long-term holdings, while protecting your private keys and recovery phrase.Review Proof of Reserves reports and their limitations.Enable 2FA or passkeys where available.Use unique passwords and secure your email account.Avoid suspicious links and never share wallet recovery phrases.Consider diversifying your exposure instead of keeping all assets on one platform.
Self-custody also carries risks, including lost recovery phrases and malicious transactions. The goal is to understand the trade-offs and choose an appropriate level of protection.
Frequently Asked Questions
Is my money safe on Binance?
Binance uses Proof of Reserves, SAFU, account security controls, and AI-assisted risk monitoring to protect customer assets. These measures reduce risks, but no centralized exchange is completely risk-free. Users should review current reserve reports, enable security features, and understand the limitations of available protections.
What happens to my money if Binance shuts down?
The outcome would depend on Binance's financial condition, custody arrangements, applicable laws, and any insolvency proceedings. Users could face withdrawal restrictions or a claims process. Proof of Reserves does not guarantee that all assets will be returned immediately.
What security measures does Binance use to prevent unauthorized transactions?
Binance uses authentication methods, withdrawal controls, transaction monitoring, and automated fraud detection. Users can strengthen protection by enabling 2FA, using unique passwords, and avoiding phishing attempts.
How is Binance's SAFU fund different from Proof of Reserves?
Proof of Reserves helps users verify reported asset backing. SAFU is an emergency fund intended to cover eligible losses from certain security incidents. They serve different purposes and do not guarantee protection against every risk.
Does Binance reimburse users if funds are stolen in a hack?
Binance has SAFU to help compensate eligible users for certain security-related losses, but reimbursement is not automatically guaranteed in every case.
In May 2019, Binance committed to covering approximately $40 million in losses following a security breach involving 7,000 BTC.
On October 30, 2026, Binance reported a security incident with an estimated financial impact of approximately $6.3 billion and stated that it would cover all losses using SAFU and company funds. The exchange also reported that approximately $3 billion in affected assets had been frozen on-chain.
Users should consult official Binance announcements for updates and contact Binance Support if they believe they qualify for compensation.
Final Thoughts: How Should You Evaluate Binance's Security?
Binance offers multiple safeguards designed to protect customer assets. Proof of Reserves supports transparency, SAFU provides an emergency financial resource, and AI-powered systems help detect suspicious activity.
However, each has limitations. Reserve verification does not guarantee solvency, SAFU does not promise reimbursement for every loss, and AI cannot prevent every attack.
The reported incident on October 30, 2026, reinforces why users should evaluate not only an exchange's security features but also its incident response, financial commitments, and updated reserve disclosures.
The smartest approach is to verify rather than assume: review available reserve information, secure your account, understand exchange custody risks, and avoid keeping more assets on a platform than necessary.
#SAFU🙏 #Hack #LazarusGroup #ProofOfReserves #Binance
$BTC $ETH $BNB

CZ-nin Freedom of Money kitabında oxumuşam (Memo, 9/4 tarixli).
2017-ci ildə Çin kriptovalyuta ticarətinə, mayninqə və ICO-lara qarşı tədbirlər görəndə, bəzi ICO emitentləri investorlarına pullarını geri qaytarmalı oldular.

Binance dərin likvidliyə, dar spredlərə, 1000-dən çox ödəniş kanalına və 100-dən çox fiat valyutasına dəstəyə malik olduğuna görə P2P əməliyyatları üçün təhlükəsizdir.
P2P ticarəti nədir?
Peer-to-peer (P2P) trading bank və ya broker kimi vasitəçi olmadan, iki şəxs arasında aktivlərin birbaşa alınıb-satılmasına deyilir. Bu konsepsiyanın kökü Bitcoin-in ilkin ideyasına gedib çıxır. Satoshi Nakamoto 2009-cu ildə onu insanların maliyyə qurumundan keçmədən bir-birinə göndərə biləcəyi elektron pul sistemi kimi təqdim etmişdi.

Giriş: Hər gün eyni işi təkrarlamağa son qoyun
Qrafikləri yoxlamağa, tokenləri araşdırmağa, bazar vəziyyətini nəzərdən keçirməyə və hər gün eyni təhlili təkrarlamağa nə qədər vaxt sərf edirsiniz?
Aktiv kripto istifadəçisisinizsə, yəqin ki, bu gündəlik iş qaydasına bələdsiniz.
Binance-i açın. Bitcoin-i yoxlayın. Altcoin-ləri nəzərdən keçirin. Həcm sıçrayışlarını axtarın. Bazar xəbərlərini oxuyun. İzləmə siyahınızı yoxlayın. Bir neçə saat sonra bütün bunları təkrarlayın.
Problem mütləq məlumat çatışmazlığı deyil. Problem həmin məlumatı faydalı bir şeyə çevirmək üçün tələb olunan əl əməyinin həcmidir.