Binance has released its initial detailed security incident report following the sophisticated cyberattack on October 29, 2026. The incident affected multiple blockchain networks and exposed serious weaknesses in parts of its internal wallet-signing infrastructure.
Binance acknowledged that this incident should never have happened and issued an apology to users, partners, and the wider cryptocurrency industry for the concern, disruption, and uncertainty caused.
The exchange also emphasized that users will not bear the financial losses. Binance says it will absorb the entire financial impact of the stolen funds.
Let's break down what happened, how the attackers gained access, and what Binance has done to strengthen its security.
🔴 1. HOW MUCH WAS LOST?
According to Binance's latest report:
Total digital assets impacted: Approximately $6.34 billion.
Assets frozen or intercepted: Approximately $2.85 billion.
Replenishment progress: 98% of impacted token assets.
Remaining assets: Binance is purchasing the outstanding, less-liquid tokens.
Financial coverage: Binance says it has set aside more than 100% of the funds required to cover the loss.
Binance also confirmed that the replenished assets are verifiable through its Proof of Reserves page.
The company stated that user funds will remain protected and that it will take responsibility for covering the incident's financial impact.
⚠️ 2. WHAT HAPPENED ON OCTOBER 29?
The attack unfolded rapidly across several blockchain networks.
Between 20:05 UTC and 20:09 UTC, five Binance hot wallets transferred approximately 233.46 million XRP to an attacker-controlled address.
Other unauthorized transfers included:
Approximately 970,500 SOL from Binance hot wallets on Solana.
Approximately 44.2 million OP from Binance hot wallets on Optimism.
Approximately 18,270 BTC transferred to an attacker-controlled address.
Additional ETH movements involving Ethereum's EIP-7702 authorization mechanism.
Binance received an internal alert about large-volume transfers and immediately launched an investigation.
The attackers had exploited unauthorized access to an internal wallet-signing service, allowing them to initiate transactions outside the normal withdrawal process.
🔴 3. HOW DID THE ATTACKERS EXPLOIT EIP-7702?
One of the most technically significant parts of this incident involved Ethereum's EIP-7702 authorization mechanism.
EIP-7702 allows an externally owned account to delegate certain execution permissions to a smart contract without directly exposing its private key.
In this incident, attackers used the mechanism to grant an attacker-controlled smart contract partial execution rights over a Binance hot wallet.
The attackers reportedly submitted 50 signing transactions to manipulate account nonces and establish malicious delegation authorizations.
Once these permissions were established, the attackers could continue moving assets independently of Binance's normal withdrawal infrastructure.
This explains why simply suspending withdrawals was not enough to stop every unauthorized transaction.
Binance also faced additional technical challenges because the affected hot wallet used Multi-Party Computation (MPC).
MPC means there is no single private key that can simply be used to immediately revoke the malicious authorization.
The security team had to develop and execute a specialized procedure to revoke the unauthorized on-chain permissions.
The final unauthorized transfer of approximately 2,961.9 ETH was finalized on-chain at 23:56 UTC.
At 00:10 UTC on October 30, Binance executed a new authorization from the Binance14 hot wallet to the zero address, clearing the EIP-7702 delegation code.
No further unauthorized transfers were observed after that point.
🕵️ 4. HOW WAS THE ATTACK PREPARED?
Binance's investigation indicates that this was not a simple phishing attack or an isolated security breach.
It was a sophisticated, multi-stage campaign involving social engineering, malicious software, compromised developer environments, internal AI tooling, and unauthorized access to wallet-signing operations.
The report describes several important stages.
June 2026 – Supply Chain Attack
An engineer working in Wallet DevOps downloaded a tampered Homebrew installation while attempting to install a popular AI coding tool through a search engine.
Binance detected the suspicious activity, replaced the affected device, and rotated related credentials.
However, the attackers had already gained exposure to information about the engineer's role and colleagues working on wallet infrastructure.
September 2026 – Fake Recruitment Interviews
Another software engineer was approached through a legitimate job-hunting platform by someone pretending to be a project director.
The attackers organized two interview rounds.
During the first interview, a fake HR representative used a live video call and shared personal social media photos and videos to build trust.
During the second interview, the engineer was instructed to download an assignment containing a malicious code repository.
The repository executed malicious code during setup.
The malware used advanced obfuscation and evasion techniques, replacing a legitimate development tool component with a malicious version.
It then executed commands and established communication with an attacker-controlled external server.
The malware reportedly avoided detection by endpoint security tools at that time.
October 20, 2026 – Internal AI Tool Compromised
The attackers leveraged the compromised computer of the second engineer and used an internal AI tool as a stepping stone to gain access to other employees, including Wallet DevOps Engineer A and Wallet Software Engineer C.
They subsequently discovered a container deployment permission token on Engineer A's computer.
This provided another opportunity to move closer to Binance's wallet infrastructure.
October 29, 2026 – Wallet Signing Operations Targeted
Between 17:15 and 19:56 UTC, the attacker accessed Software Engineer C's computer, used credentials stolen from Wallet DevOps Engineer A, deployed a container, and triggered a malicious script.
This ultimately enabled the attackers to reach wallet-signing operations and execute the unauthorized transfers.
🇰🇵 5. WHO WAS RESPONSIBLE?
According to Binance's report, the latest information released by the Federal Bureau of Investigation (FBI) indicates that North Korea's Democratic People's Republic of Korea (DPRK) was responsible for the incident.
Binance also revealed that its security team detected and prevented 57 suspected North Korea-linked cyber threat cases throughout 2026.
These attempts involved techniques such as:
Fraudulent recruitment interviews.
Malicious developer software.
Compromised software packages.
Malicious browser extensions.
Fake video conferencing applications.
Social engineering campaigns.
Credential theft and remote-access malware.
This highlights the growing cybersecurity threat facing cryptocurrency exchanges and blockchain infrastructure.
🛡️ 6. WHAT HAS BINANCE DONE TO IMPROVE SECURITY?
As of November 3, 2026, Binance reports that it has already implemented several security improvements.
These include:
Rebuilding the affected wallet system in a new environment.
Rebuilding the affected internal AI tool and strengthening access controls.
Replacing affected employee devices.
Decommissioning credentials and tokens associated with affected engineers.
Completing enhanced security scans across employee devices.
Improving AI-based behavioural anomaly detection.
Strengthening wallet-service risk controls.
Coordinating with law enforcement, blockchain intelligence companies, and industry partners to trace and freeze stolen assets.
Binance says the entry points used in the attack have been closed and systems involved in the attack path have been rebuilt or replaced.
🔍 7. WHAT HAPPENS NEXT?
Binance has announced three major areas of additional security investment.
1. Independent Cybersecurity Review
Binance is engaging independent third-party cybersecurity experts to conduct a comprehensive review of the incident, validate its findings, and recommend further security improvements.
2. Expanded AI Security Investment
The exchange plans to increase investment in:
AI-powered threat detection.
Endpoint protection.
Developer environment security.
Behavioural anomaly monitoring.
3. Security Research Fund and Industry Initiatives
Binance is working to establish a security research fund and targeted initiatives with leading AI companies, blockchain industry participants, and cybersecurity firms.
The goal is to improve AI security and prevent similar attacks across blockchain environments.
📊 8. THE BIGGER PICTURE
This incident is an important reminder that even major cryptocurrency exchanges face sophisticated cybersecurity threats.
The attack did not rely on just one vulnerability. It combined social engineering, compromised developer tools, stolen credentials, internal system access, and advanced blockchain authorization techniques.
The incident also demonstrates that protecting digital assets requires more than securing private keys.
Wallet-signing services, employee devices, developer environments, AI tools, access permissions, and on-chain authorization mechanisms all need strong security controls.
Binance says it will continue sharing information as the investigation progresses. Some technical details will remain confidential to prevent attackers from exploiting them.
MY TAKE:
The most important questions now are whether Binance can demonstrate lasting improvements in its security infrastructure, how effectively independent experts validate the investigation, and whether the industry learns from this incident.
Recovering the financial losses is important, but preventing another attack is even more important.
The cryptocurrency industry needs stronger security standards, better employee protection, and more transparent incident reporting.
What do you think?
Can Binance fully rebuild user confidence after a $6.34 billion security incident?
Is AI-powered security becoming essential for cryptocurrency exchanges?
Should all major exchanges publish more detailed independent security audit reports?
Share your thoughts in the comments.
Source: Binance's initial security incident report. Investigation and independent review remain ongoing.
Not financial advice. Always do your own research (DYOR) and manage your risk.$