#binanceincidentreport
binanceincidentreport
Hot
Latest
·
--
Article
29 October 2026 Binance Security Incident: Initial Findings and Response UpdateOn 29 October 2026, Binance experienced a serious and highly sophisticated security incident. This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry.Our first responsibility is to protect users. Binance will absorb the financial impact of the stolen funds, not our users. We have already set aside more than 100% of the funds required to cover the loss. As of 31 October 2026, 98% of the impacted token assets have been replenished and are verifiable on our Proof of Reserves page. We are in the process of purchasing the outstanding, more illiquid assets.Approximately USD 6.34 billion in digital assets were impacted by the incident. As of this update, approximately USD 2.85 billion in digital assets have been frozen or intercepted, subject to reconciliation and market price volatility.We have taken immediate action to contain the incident and strengthen the systems involved. The entry points identified as having been used in the attack have been closed. Systems touched in the attack path have been rebuilt or replaced. We have also implemented tighter device controls, enhanced wallet-service risk controls and expanded AI-based behavioural anomaly detection.This is our initial report. It covers what we know today and what we have already improved. The investigation remains ongoing and our findings will be subject to further independent review. Some technical details will remain confidential to prevent malicious actors from using them to plan attacks. We are engaging independent security firms for further review. The latest information released by the Federal Bureau of Investigation indicates that the Democratic People’s Republic of Korea is responsible for this incident.We are sharing this initial report because security improves when the industry learns together.What happened on 29 OctoberThe attack unfolded quickly across several networks.The attacker exploited unauthorized access to an internal wallet signing service to initiate transactions outside the normal withdrawal process.Between 20:05 UTC and 20:09 UTC, five Binance hot wallets sent 233.46 million XRP to an attacker-controlled address.Binance hot wallets on Solana and Optimism sent approximately 970,500 SOL and 44.2 million OP to attacker-controlled addresses.Binance then received an internal alert regarding large-volume transfers and immediately began investigating.Binance hot wallet sent 18,270 BTC to an attacker-controlled address. The attacker then used the signing service to exploit Ethereum’s EIP-7702 authorization mechanism. EIP-7702 allows an account to delegate certain execution rights to a smart contract without exposing the private key. In this case, the attacker used that mechanism to give an attacker-controlled smart contract partial execution rights over a Binance hot wallet. Binance immediately initiated multiple containment measures, including suspending withdrawals to restrict further outflows, coordinating with partners to freeze affected tokens, and taking steps to revoke unauthorized permissions. These efforts froze a total of $2.85 billion in assets.However, suspending withdrawals alone could not stop all unauthorized asset movements. The malicious EIP-7702 authorizations existed on-chain and operated independently of Binance’s normal withdrawal infrastructure.The attackers submitted 50 signing transactions to manipulate the account nonce and establish malicious delegation authorizations. Once established, these authorizations enabled the attackers to continue moving assets independently of Binance's normal withdrawal infrastructure. Binance needed additional transactions to revoke these on-chain authorizations.The containment process involved additional technical complexities. Because the hot wallet used Multi-Party Computation (MPC), there was no single private key that could be used to immediately revoke the malicious EIP-7702 authorizations. The team therefore developed and executed a specialized procedure to revoke these authorizations, which required additional time. Furthermore, suspending withdrawals and shutting down hot wallet services did not automatically invalidate existing on-chain authorizations.These challenges extended the time required to fully contain the unauthorized asset movements. We are reviewing the incident response process, signing policy coverage, hot wallet controls and identifying opportunities to further strengthen our ability to respond rapidly to threats in the future.The final unauthorized transfer of 2,961.9 ETH finalised on-chain at 23:56 UTC. The transaction had previously been broadcast and remained pending before subsequently finalising. No further unauthorised transfers were observed after.At 00:10 UTC on 30 October 2026, Binance executed a new authorization from the Binance14 hot wallet to the zero address, clearing the EIP-7702 delegation code.Attack Preparation Our current investigation indicates that this was a sophisticated, multi-stage campaign. It was not a single isolated breach or a simple phishing incident. The attackers combined a range of techniques, including social engineering by fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise, and an advanced transaction-authorisation method.June 2026 — Supply chain attack. Engineer A from Wallet DevOps downloaded a tampered Homebrew installation in order to install a popular AI coding tool after searching for it on a search engine. Our security team detected the anomaly, replaced the device, and rotated all related credentials as a proactive security action. However, Engineer A’s role and his related colleagues on our wallet infrastructure team was exposed to the hacker. Throughout 2026, Binance's security team detected and prevented 57 suspected North Korea-linked cyber threat cases. These attempts reflect the persistent threat posed by state-sponsored actors targeting the cryptocurrency industry. The techniques include fraudulent job interviews, malicious software disguised as popular developer tools, compromised software packages and browser extensions, fake video conferencing applications, and social engineering campaigns designed to steal credentials or deploy remote access malware.September 2026 — social engineering. Software Engineer B was contacted through a legitimate job-hunting platform by an individual posing as a Project Director. Software Engineer B had a profile on the platform that referenced his experience at Binance. The purported Project Director arranged a first-round interview with a HR representative, followed by a second-round interview with an individual claiming to be the CEO of a fictitious company.In the first round, the purported HR representative conducted a live video interview with Software Engineer B. The interviewer shared a social media account with him, including personal photos and videos posted on the platform, in order to build trust. This was more advanced and deceptive than previously seen social engineering approaches. The second interview was conducted in a popular social chat app, near the end of the interview, Engineer B was instructed to download an “assignment” containing a malicious code repository onto his work computer. The repository contained malicious code that executed during the setup process, initiating a series of unauthorized activities.The malware employed sophisticated obfuscation and evasion techniques, including replacing a legitimate development tool component with a malicious version to execute commands and establish communication with an attacker-controlled external server. The 0-day malware was not detected by the endpoint security protection tools at the time. The attacker also took steps to conceal the malicious activity and remove traces of the compromise, making detection and subsequent investigation more challenging.The script executed the below steps by applying obfuscation techniques to evade security detection.CREATE /opt/homebrew/Cellar/pyenv/2.8.0/libexec/pyenv_ MODIFY pyenv_ → 3,414 B DELETE .../libexec/pyenv (3,344 B) ← remove the valid pyenvRENAME pyenv_ → pyenv (3,414 B) ← replace it with a malicious version DELETE /opt/homebrew/bin/pyenv (3,414 B)ln (create a new symlink) + spawn zsh20 October, 2026 — use of an internal AI tool as a springboard. The attacker leveraged the compromised computer of engineer B and used an internal AI tool to gain control over the Wallet DevOps Engineer A and another Wallet Software Engineer C. The attacker soon discovered Wallet DevOps Engineer A had a container deployment permission token on his computer.29 October, 2026 — reach into wallet signing operations. On 29 October between 17:15 and 19:56, the attacker logged onto Software Engineer C’s computer, used the credentials stolen from Wallet DevOps Engineer A, deployed a container, and triggered a malicious script to launch the attack.What we have doneAs of Nov 3, 2026, we have taken the following actions:Rebuilt the affected wallet system in a new environment.Rebuilt the affected internal AI tool and access controls.Replaced affected devices.Decommissioned credentials and tokens related to affected engineers.Completed enhanced security scans across all employee devices.Enhanced AI-based behavioural anomaly detection.Strengthened wallet-service risk controls.Worked with law enforcement, blockchain intelligence firms and industry partners to trace and freeze affected assets.We will continue to strengthen our measures as the investigation progresses. There are a number of security measures we have implemented and are implementing that will remain private to prevent malicious actors from compromising our security.Further actionsWe are taking the following steps immediately.1. Independent cybersecurity reviewWe are engaging independent third-party cybersecurity experts to conduct a comprehensive review of the incident, validate our findings and recommend additional measures. The scope and findings of that review will inform our continuing remediation work.2. Expanded investment in AI security and preventionWe are increasing investment in AI-enabled detection, endpoint protection, developer-environment security and behavioural anomaly monitoring.3. Security research fund and industry initiativesWe are working on establishing a security research fund and targeted initiatives with leading AI companies, industry participants and security firms focused on AI security in blockchain environments.We will continue to proactively share information as and when we have it.
29 October 2026 Binance Security Incident: Initial Findings and Response Update
On 29 October 2026, Binance experienced a serious and highly sophisticated security incident. This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry.Our first responsibility is to protect users. Binance will absorb the financial impact of the stolen funds, not our users. We have already set aside more than 100% of the funds required to cover the loss. As of 31 October 2026, 98% of the impacted token assets have been replenished and are verifiable on our Proof of Reserves page. We are in the process of purchasing the outstanding, more illiquid assets.Approximately USD 6.34 billion in digital assets were impacted by the incident. As of this update, approximately USD 2.85 billion in digital assets have been frozen or intercepted, subject to reconciliation and market price volatility.We have taken immediate action to contain the incident and strengthen the systems involved. The entry points identified as having been used in the attack have been closed. Systems touched in the attack path have been rebuilt or replaced. We have also implemented tighter device controls, enhanced wallet-service risk controls and expanded AI-based behavioural anomaly detection.This is our initial report. It covers what we know today and what we have already improved. The investigation remains ongoing and our findings will be subject to further independent review. Some technical details will remain confidential to prevent malicious actors from using them to plan attacks. We are engaging independent security firms for further review. The latest information released by the Federal Bureau of Investigation indicates that the Democratic People’s Republic of Korea is responsible for this incident.We are sharing this initial report because security improves when the industry learns together.What happened on 29 OctoberThe attack unfolded quickly across several networks.The attacker exploited unauthorized access to an internal wallet signing service to initiate transactions outside the normal withdrawal process.Between 20:05 UTC and 20:09 UTC, five Binance hot wallets sent 233.46 million XRP to an attacker-controlled address.Binance hot wallets on Solana and Optimism sent approximately 970,500 SOL and 44.2 million OP to attacker-controlled addresses.Binance then received an internal alert regarding large-volume transfers and immediately began investigating.Binance hot wallet sent 18,270 BTC to an attacker-controlled address. The attacker then used the signing service to exploit Ethereum’s EIP-7702 authorization mechanism. EIP-7702 allows an account to delegate certain execution rights to a smart contract without exposing the private key. In this case, the attacker used that mechanism to give an attacker-controlled smart contract partial execution rights over a Binance hot wallet. Binance immediately initiated multiple containment measures, including suspending withdrawals to restrict further outflows, coordinating with partners to freeze affected tokens, and taking steps to revoke unauthorized permissions. These efforts froze a total of $2.85 billion in assets.However, suspending withdrawals alone could not stop all unauthorized asset movements. The malicious EIP-7702 authorizations existed on-chain and operated independently of Binance’s normal withdrawal infrastructure.The attackers submitted 50 signing transactions to manipulate the account nonce and establish malicious delegation authorizations. Once established, these authorizations enabled the attackers to continue moving assets independently of Binance's normal withdrawal infrastructure. Binance needed additional transactions to revoke these on-chain authorizations.The containment process involved additional technical complexities. Because the hot wallet used Multi-Party Computation (MPC), there was no single private key that could be used to immediately revoke the malicious EIP-7702 authorizations. The team therefore developed and executed a specialized procedure to revoke these authorizations, which required additional time. Furthermore, suspending withdrawals and shutting down hot wallet services did not automatically invalidate existing on-chain authorizations.These challenges extended the time required to fully contain the unauthorized asset movements. We are reviewing the incident response process, signing policy coverage, hot wallet controls and identifying opportunities to further strengthen our ability to respond rapidly to threats in the future.The final unauthorized transfer of 2,961.9 ETH finalised on-chain at 23:56 UTC. The transaction had previously been broadcast and remained pending before subsequently finalising. No further unauthorised transfers were observed after.At 00:10 UTC on 30 October 2026, Binance executed a new authorization from the Binance14 hot wallet to the zero address, clearing the EIP-7702 delegation code.Attack Preparation Our current investigation indicates that this was a sophisticated, multi-stage campaign. It was not a single isolated breach or a simple phishing incident. The attackers combined a range of techniques, including social engineering by fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise, and an advanced transaction-authorisation method.June 2026 — Supply chain attack. Engineer A from Wallet DevOps downloaded a tampered Homebrew installation in order to install a popular AI coding tool after searching for it on a search engine. Our security team detected the anomaly, replaced the device, and rotated all related credentials as a proactive security action. However, Engineer A’s role and his related colleagues on our wallet infrastructure team was exposed to the hacker. Throughout 2026, Binance's security team detected and prevented 57 suspected North Korea-linked cyber threat cases. These attempts reflect the persistent threat posed by state-sponsored actors targeting the cryptocurrency industry. The techniques include fraudulent job interviews, malicious software disguised as popular developer tools, compromised software packages and browser extensions, fake video conferencing applications, and social engineering campaigns designed to steal credentials or deploy remote access malware.September 2026 — social engineering. Software Engineer B was contacted through a legitimate job-hunting platform by an individual posing as a Project Director. Software Engineer B had a profile on the platform that referenced his experience at Binance. The purported Project Director arranged a first-round interview with a HR representative, followed by a second-round interview with an individual claiming to be the CEO of a fictitious company.In the first round, the purported HR representative conducted a live video interview with Software Engineer B. The interviewer shared a social media account with him, including personal photos and videos posted on the platform, in order to build trust. This was more advanced and deceptive than previously seen social engineering approaches. The second interview was conducted in a popular social chat app, near the end of the interview, Engineer B was instructed to download an “assignment” containing a malicious code repository onto his work computer. The repository contained malicious code that executed during the setup process, initiating a series of unauthorized activities.The malware employed sophisticated obfuscation and evasion techniques, including replacing a legitimate development tool component with a malicious version to execute commands and establish communication with an attacker-controlled external server. The 0-day malware was not detected by the endpoint security protection tools at the time. The attacker also took steps to conceal the malicious activity and remove traces of the compromise, making detection and subsequent investigation more challenging.The script executed the below steps by applying obfuscation techniques to evade security detection.CREATE /opt/homebrew/Cellar/pyenv/2.8.0/libexec/pyenv_ MODIFY pyenv_ → 3,414 B DELETE .../libexec/pyenv (3,344 B) ← remove the valid pyenvRENAME pyenv_ → pyenv (3,414 B) ← replace it with a malicious version DELETE /opt/homebrew/bin/pyenv (3,414 B)ln (create a new symlink) + spawn zsh20 October, 2026 — use of an internal AI tool as a springboard. The attacker leveraged the compromised computer of engineer B and used an internal AI tool to gain control over the Wallet DevOps Engineer A and another Wallet Software Engineer C. The attacker soon discovered Wallet DevOps Engineer A had a container deployment permission token on his computer.29 October, 2026 — reach into wallet signing operations. On 29 October between 17:15 and 19:56, the attacker logged onto Software Engineer C’s computer, used the credentials stolen from Wallet DevOps Engineer A, deployed a container, and triggered a malicious script to launch the attack.What we have doneAs of Nov 3, 2026, we have taken the following actions:Rebuilt the affected wallet system in a new environment.Rebuilt the affected internal AI tool and access controls.Replaced affected devices.Decommissioned credentials and tokens related to affected engineers.Completed enhanced security scans across all employee devices.Enhanced AI-based behavioural anomaly detection.Strengthened wallet-service risk controls.Worked with law enforcement, blockchain intelligence firms and industry partners to trace and freeze affected assets.We will continue to strengthen our measures as the investigation progresses. There are a number of security measures we have implemented and are implementing that will remain private to prevent malicious actors from compromising our security.Further actionsWe are taking the following steps immediately.1. Independent cybersecurity reviewWe are engaging independent third-party cybersecurity experts to conduct a comprehensive review of the incident, validate our findings and recommend additional measures. The scope and findings of that review will inform our continuing remediation work.2. Expanded investment in AI security and preventionWe are increasing investment in AI-enabled detection, endpoint protection, developer-environment security and behavioural anomaly monitoring.3. Security research fund and industry initiativesWe are working on establishing a security research fund and targeted initiatives with leading AI companies, industry participants and security firms focused on AI security in blockchain environments.We will continue to proactively share information as and when we have it.
boideptraizz:
Tóm lại là cho bọn tôi rút tiền từ tài khoản dự đoán về tài khoản spot đi tôi biết các bạn đang cố tình làm điều này
29
20
115
293.5k
A difficult moment for Binance. A critical lesson for the entire crypto industry.
The recent security incident involving approximately $6.3 billion in token assets is a reminder that security, transparency, and accountability must remain at the centre of every crypto exchange.
But the important part is what happens next.
Binance has published several recovery updates, and its latest announcement on November 3 confirms that withdrawals are reopening for more assets.
Here are some important developments from Binance's official updates:
- October 29: Binance identified unauthorized withdrawals involving compromised hot-wallet infrastructure.
- October 30: Binance confirmed the incident and stated that it would absorb the financial impact rather than pass the losses to users.
- October 31: Binance reported that 90% of the affected assets had been replenished.
- November 2: Binance confirmed that the October 31 Proof of Reserves snapshot had a completed zero-knowledge proof, enabling independent verification for ten listed assets.
- November 3: Binance published Recovery Update #6, announcing that withdrawals were reopening for more assets.
My personal take:
In crypto, trust should never depend only on a company's reputation. It should be supported by verifiable information, transparent communication, strong security measures, and accountability.
I believe this incident should encourage every exchange to review its security infrastructure and improve its transparency standards.
The most important thing now is continued progress, clear communication, and a comprehensive technical explanation of what happened and how similar incidents can be prevented.
The crypto industry grows stronger when security is treated as a responsibility, not an option.
What is your biggest takeaway from this incident?
#BinanceIncidentReport #CryptoSecurity #ProofOfReserves
A difficult moment for Binance. A critical lesson for the entire crypto industry.
The recent security incident involving approximately $6.3 billion in token assets is a reminder that security, transparency, and accountability must remain at the centre of every crypto exchange.
But the important part is what happens next.
Binance has published several recovery updates, and its latest announcement on November 3 confirms that withdrawals are reopening for more assets.
Here are some important developments from Binance's official updates:
- October 29: Binance identified unauthorized withdrawals involving compromised hot-wallet infrastructure.
- October 30: Binance confirmed the incident and stated that it would absorb the financial impact rather than pass the losses to users.
- October 31: Binance reported that 90% of the affected assets had been replenished.
- November 2: Binance confirmed that the October 31 Proof of Reserves snapshot had a completed zero-knowledge proof, enabling independent verification for ten listed assets.
- November 3: Binance published Recovery Update #6, announcing that withdrawals were reopening for more assets.
My personal take:
In crypto, trust should never depend only on a company's reputation. It should be supported by verifiable information, transparent communication, strong security measures, and accountability.
I believe this incident should encourage every exchange to review its security infrastructure and improve its transparency standards.
The most important thing now is continued progress, clear communication, and a comprehensive technical explanation of what happened and how similar incidents can be prevented.
The crypto industry grows stronger when security is treated as a responsibility, not an option.
What is your biggest takeaway from this incident?
#BinanceIncidentReport #CryptoSecurity #ProofOfReserves
The recent security incident involving approximately $6.3 billion in token assets is a reminder that security, transparency, and accountability must remain at the centre of every crypto exchange.
But the important part is what happens next.
Binance has published several recovery updates, and its latest announcement on November 3 confirms that withdrawals are reopening for more assets.
Here are some important developments from Binance's official updates:
- October 29: Binance identified unauthorized withdrawals involving compromised hot-wallet infrastructure.
- October 30: Binance confirmed the incident and stated that it would absorb the financial impact rather than pass the losses to users.
- October 31: Binance reported that 90% of the affected assets had been replenished.
- November 2: Binance confirmed that the October 31 Proof of Reserves snapshot had a completed zero-knowledge proof, enabling independent verification for ten listed assets.
- November 3: Binance published Recovery Update #6, announcing that withdrawals were reopening for more assets.
My personal take:
In crypto, trust should never depend only on a company's reputation. It should be supported by verifiable information, transparent communication, strong security measures, and accountability.
I believe this incident should encourage every exchange to review its security infrastructure and improve its transparency standards.
The most important thing now is continued progress, clear communication, and a comprehensive technical explanation of what happened and how similar incidents can be prevented.
The crypto industry grows stronger when security is treated as a responsibility, not an option.
What is your biggest takeaway from this incident?
#BinanceIncidentReport #CryptoSecurity #ProofOfReserves
1
626
·
--
🚨💰 BINANCE HACKED! When Hackers Come Knocking, Even Crypto Giants Must Answer! 🔐🤖The crypto world received another uncomfortable reminder on October 29: even the biggest players aren't bulletproof! 😳 Binance has published its initial findings and response following a massive security incident that exposed vulnerabilities in its internal infrastructure.
🔍 According to the investigation, attackers allegedly exploited compromised employee infrastructure to gain access to internal systems and authorize malicious transactions. Even more interesting, reports suggest a fake job interview played a role in compromising a computer before internal AI tools were allegedly exploited. Talk about a job interview from hell! 😂💻
💰 Binance says it has mobilized substantial financial resources to absorb the impact, while working with security experts, blockchain investigators and law enforcement to contain the incident and freeze affected assets.
🛡️ The exchange has also promised stronger security controls, improved threat detection and greater transparency through updated Proof of Reserves reporting.
🤔 But here's the bigger lesson: Blockchain technology may be decentralized, transparent and incredibly sophisticated, but the companies operating within the ecosystem still have very human vulnerabilities.
An exchange can build digital fortresses, deploy armies of cybersecurity experts and invest millions in technology, yet one compromised laptop can potentially open doors that should have remained locked!
🔑 And this is another reminder of why self-custody matters. Not your keys, not your coins! Of course, holding your own keys also means becoming your own security department. No customer support hotline can magically recover a forgotten seed phrase! 🤣
🌍 Ultimately, Binance's response will be judged not just by how much money it can cover, but by how transparently it explains what happened and prevents a repeat.
🚀 Crypto promises financial freedom. Protecting that freedom requires security, accountability and constant vigilance!
#BinanceIncidentReport
$BNB $BTC
{spot}(BTCUSDT)
{spot}(BNBUSDT)
🚨💰 BINANCE HACKED! When Hackers Come Knocking, Even Crypto Giants Must Answer! 🔐🤖
The crypto world received another uncomfortable reminder on October 29: even the biggest players aren't bulletproof! 😳 Binance has published its initial findings and response following a massive security incident that exposed vulnerabilities in its internal infrastructure.
🔍 According to the investigation, attackers allegedly exploited compromised employee infrastructure to gain access to internal systems and authorize malicious transactions. Even more interesting, reports suggest a fake job interview played a role in compromising a computer before internal AI tools were allegedly exploited. Talk about a job interview from hell! 😂💻
💰 Binance says it has mobilized substantial financial resources to absorb the impact, while working with security experts, blockchain investigators and law enforcement to contain the incident and freeze affected assets.
🛡️ The exchange has also promised stronger security controls, improved threat detection and greater transparency through updated Proof of Reserves reporting.
🤔 But here's the bigger lesson: Blockchain technology may be decentralized, transparent and incredibly sophisticated, but the companies operating within the ecosystem still have very human vulnerabilities.
An exchange can build digital fortresses, deploy armies of cybersecurity experts and invest millions in technology, yet one compromised laptop can potentially open doors that should have remained locked!
🔑 And this is another reminder of why self-custody matters. Not your keys, not your coins! Of course, holding your own keys also means becoming your own security department. No customer support hotline can magically recover a forgotten seed phrase! 🤣
🌍 Ultimately, Binance's response will be judged not just by how much money it can cover, but by how transparently it explains what happened and prevents a repeat.
🚀 Crypto promises financial freedom. Protecting that freedom requires security, accountability and constant vigilance!
#BinanceIncidentReport
$BNB $BTC
🔍 According to the investigation, attackers allegedly exploited compromised employee infrastructure to gain access to internal systems and authorize malicious transactions. Even more interesting, reports suggest a fake job interview played a role in compromising a computer before internal AI tools were allegedly exploited. Talk about a job interview from hell! 😂💻
💰 Binance says it has mobilized substantial financial resources to absorb the impact, while working with security experts, blockchain investigators and law enforcement to contain the incident and freeze affected assets.
🛡️ The exchange has also promised stronger security controls, improved threat detection and greater transparency through updated Proof of Reserves reporting.
🤔 But here's the bigger lesson: Blockchain technology may be decentralized, transparent and incredibly sophisticated, but the companies operating within the ecosystem still have very human vulnerabilities.
An exchange can build digital fortresses, deploy armies of cybersecurity experts and invest millions in technology, yet one compromised laptop can potentially open doors that should have remained locked!
🔑 And this is another reminder of why self-custody matters. Not your keys, not your coins! Of course, holding your own keys also means becoming your own security department. No customer support hotline can magically recover a forgotten seed phrase! 🤣
🌍 Ultimately, Binance's response will be judged not just by how much money it can cover, but by how transparently it explains what happened and prevents a repeat.
🚀 Crypto promises financial freedom. Protecting that freedom requires security, accountability and constant vigilance!
#BinanceIncidentReport
$BNB $BTC
229
·
--
#BinanceIncidentReport A $6B+ hack that started with a fake job interview🚨😢Binance just dropped its initial report on how North Korean hackers pulled this off, and it's wild.
A Binance engineer had his résumé up on a job site. Someone posing as a project director reached out about a role.
Round one: a video call with "HR." Real face, on camera. She even sent him her social media, full of everyday photos and videos. Looked like a totally normal person.
Round two moved to a regular chat app with the company's "CEO." Except the company didn't exist. Near the end, they asked him to download a coding test.
That test quietly ran during setup, swapped out pyenv (a normal dev tool) for a trojanized version, phoned home to the hackers' server, and cleaned up after itself. It was 0-day malware, so the security tools out there at the time couldn't catch it yet.
From that one laptop, the hackers used an internal AI tool as a stepping stone and worked their way into the wallet signing system. Then they used EIP-7702 to give their own contract partial control over a hot wallet, right on-chain.
Thankfully Binance moved fast. Withdrawals were paused, partners helped freeze funds, and about $2.85B has been frozen or intercepted.
North Korea isn't just going after one exchange. They're going after the whole industry. Binance putting all the details out there gives everyone a chance to get ahead of it #Binance #Hack
#BinanceIncidentReport A $6B+ hack that started with a fake job interview🚨😢Binance just dropped its initial report on how North Korean hackers pulled this off, and it's wild.
A Binance engineer had his résumé up on a job site. Someone posing as a project director reached out about a role.
Round one: a video call with "HR." Real face, on camera. She even sent him her social media, full of everyday photos and videos. Looked like a totally normal person.
Round two moved to a regular chat app with the company's "CEO." Except the company didn't exist. Near the end, they asked him to download a coding test.
That test quietly ran during setup, swapped out pyenv (a normal dev tool) for a trojanized version, phoned home to the hackers' server, and cleaned up after itself. It was 0-day malware, so the security tools out there at the time couldn't catch it yet.
From that one laptop, the hackers used an internal AI tool as a stepping stone and worked their way into the wallet signing system. Then they used EIP-7702 to give their own contract partial control over a hot wallet, right on-chain.
Thankfully Binance moved fast. Withdrawals were paused, partners helped freeze funds, and about $2.85B has been frozen or intercepted.
North Korea isn't just going after one exchange. They're going after the whole industry. Binance putting all the details out there gives everyone a chance to get ahead of it #Binance #Hack
A Binance engineer had his résumé up on a job site. Someone posing as a project director reached out about a role.
Round one: a video call with "HR." Real face, on camera. She even sent him her social media, full of everyday photos and videos. Looked like a totally normal person.
Round two moved to a regular chat app with the company's "CEO." Except the company didn't exist. Near the end, they asked him to download a coding test.
That test quietly ran during setup, swapped out pyenv (a normal dev tool) for a trojanized version, phoned home to the hackers' server, and cleaned up after itself. It was 0-day malware, so the security tools out there at the time couldn't catch it yet.
From that one laptop, the hackers used an internal AI tool as a stepping stone and worked their way into the wallet signing system. Then they used EIP-7702 to give their own contract partial control over a hot wallet, right on-chain.
Thankfully Binance moved fast. Withdrawals were paused, partners helped freeze funds, and about $2.85B has been frozen or intercepted.
North Korea isn't just going after one exchange. They're going after the whole industry. Binance putting all the details out there gives everyone a chance to get ahead of it #Binance #Hack
3
1.1k
·
--
🚨 Binance Incident Report is getting attention
Only 2 people are discussing it right now — but incidents like this can move fast once more users start paying attention.
If you're a Binance user, don't ignore unusual account activity. Check your balances, withdrawal history, and security settings.
🔐 Stay alert.
📊 Verify before you react.
⚠️ Don't spread unconfirmed claims.
$AGT
{future}(AGTUSDT)
#BinanceIncidentReport
🚨 Binance Incident Report is getting attention
Only 2 people are discussing it right now — but incidents like this can move fast once more users start paying attention.
If you're a Binance user, don't ignore unusual account activity. Check your balances, withdrawal history, and security settings.
🔐 Stay alert.
📊 Verify before you react.
⚠️ Don't spread unconfirmed claims.
$AGT
#BinanceIncidentReport
Only 2 people are discussing it right now — but incidents like this can move fast once more users start paying attention.
If you're a Binance user, don't ignore unusual account activity. Check your balances, withdrawal history, and security settings.
🔐 Stay alert.
📊 Verify before you react.
⚠️ Don't spread unconfirmed claims.
$AGT
#BinanceIncidentReport
1
208
·
--
🕵️ The $6.3B $BNB hack started with a fake job interview.
📰 An engineer opened a "coding test" that hid malware, Binance's new report says.
🤔 Why it matters: the hackers never needed a single private key.
👀 BNB sits near $700, still boxed since hack night.
🎯 My take: a full report calms nerves more than any bounce.
💬 Would you have spotted the fake interview? 👇
#BinanceIncidentReport #BNB
🕵️ The $6.3B $BNB hack started with a fake job interview.
📰 An engineer opened a "coding test" that hid malware, Binance's new report says.
🤔 Why it matters: the hackers never needed a single private key.
👀 BNB sits near $700, still boxed since hack night.
🎯 My take: a full report calms nerves more than any bounce.
💬 Would you have spotted the fake interview? 👇
#BinanceIncidentReport #BNB
📰 An engineer opened a "coding test" that hid malware, Binance's new report says.
🤔 Why it matters: the hackers never needed a single private key.
👀 BNB sits near $700, still boxed since hack night.
🎯 My take: a full report calms nerves more than any bounce.
💬 Would you have spotted the fake interview? 👇
#BinanceIncidentReport #BNB
135
#BinanceIncidentReport
Binance's reported $6.3B recovery raises a bigger question about exchange resilience: how much financial pressure can a platform absorb without relying on outside funding?
According to the information provided, Binance founder CZ confirmed that the exchange covered the $6.3B hack-related loss using its own balance sheet, without borrowing, selling assets, or raising additional funds.
There are also signs of improving liquidity:
- Net outflows reportedly declined from approximately $7B to $3.5B.
- The deposit-to-withdrawal ratio recovered from approximately 20% to 78%.
My take:
The balance-sheet response is significant, but I wouldn't treat it as proof that every risk has disappeared.
The decline in outflows and recovery in the deposit-to-withdrawal ratio suggest that withdrawal pressure may be easing. That's encouraging for platform confidence.
However, the real test goes beyond covering losses. I want to see sustained withdrawal functionality, transparent reserve data, and continued liquidity stability.
One important distinction: financial capacity can absorb a shock, but it doesn't automatically eliminate the security weaknesses that caused it.
For me, the next signal is whether these liquidity improvements hold over time.
Not financial advice. Do your own research.
#BinanceIncidentReport
Binance's reported $6.3B recovery raises a bigger question about exchange resilience: how much financial pressure can a platform absorb without relying on outside funding?
According to the information provided, Binance founder CZ confirmed that the exchange covered the $6.3B hack-related loss using its own balance sheet, without borrowing, selling assets, or raising additional funds.
There are also signs of improving liquidity:
- Net outflows reportedly declined from approximately $7B to $3.5B.
- The deposit-to-withdrawal ratio recovered from approximately 20% to 78%.
My take:
The balance-sheet response is significant, but I wouldn't treat it as proof that every risk has disappeared.
The decline in outflows and recovery in the deposit-to-withdrawal ratio suggest that withdrawal pressure may be easing. That's encouraging for platform confidence.
However, the real test goes beyond covering losses. I want to see sustained withdrawal functionality, transparent reserve data, and continued liquidity stability.
One important distinction: financial capacity can absorb a shock, but it doesn't automatically eliminate the security weaknesses that caused it.
For me, the next signal is whether these liquidity improvements hold over time.
Not financial advice. Do your own research.
Binance's reported $6.3B recovery raises a bigger question about exchange resilience: how much financial pressure can a platform absorb without relying on outside funding?
According to the information provided, Binance founder CZ confirmed that the exchange covered the $6.3B hack-related loss using its own balance sheet, without borrowing, selling assets, or raising additional funds.
There are also signs of improving liquidity:
- Net outflows reportedly declined from approximately $7B to $3.5B.
- The deposit-to-withdrawal ratio recovered from approximately 20% to 78%.
My take:
The balance-sheet response is significant, but I wouldn't treat it as proof that every risk has disappeared.
The decline in outflows and recovery in the deposit-to-withdrawal ratio suggest that withdrawal pressure may be easing. That's encouraging for platform confidence.
However, the real test goes beyond covering losses. I want to see sustained withdrawal functionality, transparent reserve data, and continued liquidity stability.
One important distinction: financial capacity can absorb a shock, but it doesn't automatically eliminate the security weaknesses that caused it.
For me, the next signal is whether these liquidity improvements hold over time.
Not financial advice. Do your own research.
53
Understanding the Recent Binance Security Incident: What You Need to KnowOn October 29, 2026, the cryptocurrency industry witnessed one of its most significant security challenges to date. Binance experienced a major security breach involving unauthorized withdrawals from its hot wallet infrastructure, with total affected assets estimated at approximately $6.34 billion.
If you are an investor or user on the platform, here is a clear breakdown of how the incident unfolded, the immediate actions taken, and what it means for your funds.
How the Breach Occurred
Following an initial investigation, Binance disclosed that the breach was a sophisticated, multistage campaign. The attackers utilized social engineering tactics—including a fake job interview—targeting a DevOps engineer. By compromising the engineer's device and exploiting an internal AI tool, the malicious actors were able to access a service container and authorize unauthorized withdrawal transactions across multiple blockchain networks.
Importantly, Binance confirmed that there is no evidence of any wallet private keys being leaked. Blockchain intelligence firms, including TRM Labs and the FBI, have attributed the attack with high confidence to the North Korea-linked hacking group known as TraderTraitor.
Binance’s Immediate Response and Fund Security
The most critical takeaway for retail and institutional users is that user funds are safe. Binance has committed to covering all financial losses entirely through its Secure Asset Fund for Users (SAFU) and corporate treasury reserves.
To contain the fallout, Binance immediately:
Temporarily suspended withdrawals to conduct comprehensive security checks.
Partnered with blockchain intelligence firms and law enforcement to track and freeze stolen funds, successfully freezing roughly $3 billion on-chain so far.
Rebuilt affected systems, replaced compromised devices, and revoked the relevant credentials and tokens.
What Happens Next?
Binance is currently restoring withdrawal services in phased rollouts for various assets. The exchange has also pledged to publish a highly detailed technical post-mortem and an updated Proof of Reserves once the remediation process and independent cybersecurity reviews are complete. Moving forward, the company plans to heavily increase its investments in AI-enabled security infrastructure and industry-wide research initiatives to prevent future exploits.
While an incident of this scale is a stark reminder of the sophisticated cyber threats facing the digital asset space, Binance’s rapid containment, transparency, and full financial backing demonstrate the resilience required to protect user trust.
Stay tuned to official Binance announcements for the most accurate and up-to-date information regarding your specific assets.
$BNB
{future}(BNBUSDT)
#binanceincidentreport #Binance #Hack
Understanding the Recent Binance Security Incident: What You Need to Know
On October 29, 2026, the cryptocurrency industry witnessed one of its most significant security challenges to date. Binance experienced a major security breach involving unauthorized withdrawals from its hot wallet infrastructure, with total affected assets estimated at approximately $6.34 billion.
If you are an investor or user on the platform, here is a clear breakdown of how the incident unfolded, the immediate actions taken, and what it means for your funds.
How the Breach Occurred
Following an initial investigation, Binance disclosed that the breach was a sophisticated, multistage campaign. The attackers utilized social engineering tactics—including a fake job interview—targeting a DevOps engineer. By compromising the engineer's device and exploiting an internal AI tool, the malicious actors were able to access a service container and authorize unauthorized withdrawal transactions across multiple blockchain networks.
Importantly, Binance confirmed that there is no evidence of any wallet private keys being leaked. Blockchain intelligence firms, including TRM Labs and the FBI, have attributed the attack with high confidence to the North Korea-linked hacking group known as TraderTraitor.
Binance’s Immediate Response and Fund Security
The most critical takeaway for retail and institutional users is that user funds are safe. Binance has committed to covering all financial losses entirely through its Secure Asset Fund for Users (SAFU) and corporate treasury reserves.
To contain the fallout, Binance immediately:
Temporarily suspended withdrawals to conduct comprehensive security checks.
Partnered with blockchain intelligence firms and law enforcement to track and freeze stolen funds, successfully freezing roughly $3 billion on-chain so far.
Rebuilt affected systems, replaced compromised devices, and revoked the relevant credentials and tokens.
What Happens Next?
Binance is currently restoring withdrawal services in phased rollouts for various assets. The exchange has also pledged to publish a highly detailed technical post-mortem and an updated Proof of Reserves once the remediation process and independent cybersecurity reviews are complete. Moving forward, the company plans to heavily increase its investments in AI-enabled security infrastructure and industry-wide research initiatives to prevent future exploits.
While an incident of this scale is a stark reminder of the sophisticated cyber threats facing the digital asset space, Binance’s rapid containment, transparency, and full financial backing demonstrate the resilience required to protect user trust.
Stay tuned to official Binance announcements for the most accurate and up-to-date information regarding your specific assets.
$BNB
#binanceincidentreport #Binance #Hack
If you are an investor or user on the platform, here is a clear breakdown of how the incident unfolded, the immediate actions taken, and what it means for your funds.
How the Breach Occurred
Following an initial investigation, Binance disclosed that the breach was a sophisticated, multistage campaign. The attackers utilized social engineering tactics—including a fake job interview—targeting a DevOps engineer. By compromising the engineer's device and exploiting an internal AI tool, the malicious actors were able to access a service container and authorize unauthorized withdrawal transactions across multiple blockchain networks.
Importantly, Binance confirmed that there is no evidence of any wallet private keys being leaked. Blockchain intelligence firms, including TRM Labs and the FBI, have attributed the attack with high confidence to the North Korea-linked hacking group known as TraderTraitor.
Binance’s Immediate Response and Fund Security
The most critical takeaway for retail and institutional users is that user funds are safe. Binance has committed to covering all financial losses entirely through its Secure Asset Fund for Users (SAFU) and corporate treasury reserves.
To contain the fallout, Binance immediately:
Temporarily suspended withdrawals to conduct comprehensive security checks.
Partnered with blockchain intelligence firms and law enforcement to track and freeze stolen funds, successfully freezing roughly $3 billion on-chain so far.
Rebuilt affected systems, replaced compromised devices, and revoked the relevant credentials and tokens.
What Happens Next?
Binance is currently restoring withdrawal services in phased rollouts for various assets. The exchange has also pledged to publish a highly detailed technical post-mortem and an updated Proof of Reserves once the remediation process and independent cybersecurity reviews are complete. Moving forward, the company plans to heavily increase its investments in AI-enabled security infrastructure and industry-wide research initiatives to prevent future exploits.
While an incident of this scale is a stark reminder of the sophisticated cyber threats facing the digital asset space, Binance’s rapid containment, transparency, and full financial backing demonstrate the resilience required to protect user trust.
Stay tuned to official Binance announcements for the most accurate and up-to-date information regarding your specific assets.
$BNB
#binanceincidentreport #Binance #Hack
34
·
--
🚨 Binance Security Incident – Important Update
Binance has released its initial report regarding the October 29 security incident.
Approximately $6.34 billion in digital assets were impacted, with $2.85 billion frozen or intercepted. Binance has confirmed that users will not bear the financial losses, and 98% of the affected token assets have already been replenished.
The incident involved a sophisticated attack targeting internal wallet infrastructure. Binance has since rebuilt affected systems, strengthened security controls, replaced compromised devices and engaged independent cybersecurity experts for further review.
The key takeaway: Binance says user funds are protected, the financial impact will be covered by the exchange, and additional security measures are being implemented.
The investigation is ongoing, and we will continue monitoring official updates.
Stay informed, stay cautious, and always follow official Binance announcements. 🛡️
#BinanceIncidentReport
🚨 Binance Security Incident – Important Update
Binance has released its initial report regarding the October 29 security incident.
Approximately $6.34 billion in digital assets were impacted, with $2.85 billion frozen or intercepted. Binance has confirmed that users will not bear the financial losses, and 98% of the affected token assets have already been replenished.
The incident involved a sophisticated attack targeting internal wallet infrastructure. Binance has since rebuilt affected systems, strengthened security controls, replaced compromised devices and engaged independent cybersecurity experts for further review.
The key takeaway: Binance says user funds are protected, the financial impact will be covered by the exchange, and additional security measures are being implemented.
The investigation is ongoing, and we will continue monitoring official updates.
Stay informed, stay cautious, and always follow official Binance announcements. 🛡️
#BinanceIncidentReport
Binance has released its initial report regarding the October 29 security incident.
Approximately $6.34 billion in digital assets were impacted, with $2.85 billion frozen or intercepted. Binance has confirmed that users will not bear the financial losses, and 98% of the affected token assets have already been replenished.
The incident involved a sophisticated attack targeting internal wallet infrastructure. Binance has since rebuilt affected systems, strengthened security controls, replaced compromised devices and engaged independent cybersecurity experts for further review.
The key takeaway: Binance says user funds are protected, the financial impact will be covered by the exchange, and additional security measures are being implemented.
The investigation is ongoing, and we will continue monitoring official updates.
Stay informed, stay cautious, and always follow official Binance announcements. 🛡️
#BinanceIncidentReport
Binance Blog
·
--
29 October 2026 Binance Security Incident: Initial Findings and Response Update
On 29 October 2026, Binance experienced a serious and highly sophisticated security incident. This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry.Our first responsibility is to protect users. Binance will absorb the financial impact of the stolen funds, not our users. We have already set aside more than 100% of the funds required to cover the loss. As of 31 October 2026, 98% of the impacted token assets have been replenished and are verifiable on our Proof of Reserves page. We are in the process of purchasing the outstanding, more illiquid assets.Approximately USD 6.34 billion in digital assets were impacted by the incident. As of this update, approximately USD 2.85 billion in digital assets have been frozen or intercepted, subject to reconciliation and market price volatility.We have taken immediate action to contain the incident and strengthen the systems involved. The entry points identified as having been used in the attack have been closed. Systems touched in the attack path have been rebuilt or replaced. We have also implemented tighter device controls, enhanced wallet-service risk controls and expanded AI-based behavioural anomaly detection.This is our initial report. It covers what we know today and what we have already improved. The investigation remains ongoing and our findings will be subject to further independent review. Some technical details will remain confidential to prevent malicious actors from using them to plan attacks. We are engaging independent security firms for further review. The latest information released by the Federal Bureau of Investigation indicates that the Democratic People’s Republic of Korea is responsible for this incident.We are sharing this initial report because security improves when the industry learns together.What happened on 29 OctoberThe attack unfolded quickly across several networks.The attacker exploited unauthorized access to an internal wallet signing service to initiate transactions outside the normal withdrawal process.Between 20:05 UTC and 20:09 UTC, five Binance hot wallets sent 233.46 million XRP to an attacker-controlled address.Binance hot wallets on Solana and Optimism sent approximately 970,500 SOL and 44.2 million OP to attacker-controlled addresses.Binance then received an internal alert regarding large-volume transfers and immediately began investigating.Binance hot wallet sent 18,270 BTC to an attacker-controlled address. The attacker then used the signing service to exploit Ethereum’s EIP-7702 authorization mechanism. EIP-7702 allows an account to delegate certain execution rights to a smart contract without exposing the private key. In this case, the attacker used that mechanism to give an attacker-controlled smart contract partial execution rights over a Binance hot wallet. Binance immediately initiated multiple containment measures, including suspending withdrawals to restrict further outflows, coordinating with partners to freeze affected tokens, and taking steps to revoke unauthorized permissions. These efforts froze a total of $2.85 billion in assets.However, suspending withdrawals alone could not stop all unauthorized asset movements. The malicious EIP-7702 authorizations existed on-chain and operated independently of Binance’s normal withdrawal infrastructure.The attackers submitted 50 signing transactions to manipulate the account nonce and establish malicious delegation authorizations. Once established, these authorizations enabled the attackers to continue moving assets independently of Binance's normal withdrawal infrastructure. Binance needed additional transactions to revoke these on-chain authorizations.The containment process involved additional technical complexities. Because the hot wallet used Multi-Party Computation (MPC), there was no single private key that could be used to immediately revoke the malicious EIP-7702 authorizations. The team therefore developed and executed a specialized procedure to revoke these authorizations, which required additional time. Furthermore, suspending withdrawals and shutting down hot wallet services did not automatically invalidate existing on-chain authorizations.These challenges extended the time required to fully contain the unauthorized asset movements. We are reviewing the incident response process, signing policy coverage, hot wallet controls and identifying opportunities to further strengthen our ability to respond rapidly to threats in the future.The final unauthorized transfer of 2,961.9 ETH finalised on-chain at 23:56 UTC. The transaction had previously been broadcast and remained pending before subsequently finalising. No further unauthorised transfers were observed after.At 00:10 UTC on 30 October 2026, Binance executed a new authorization from the Binance14 hot wallet to the zero address, clearing the EIP-7702 delegation code.Attack Preparation Our current investigation indicates that this was a sophisticated, multi-stage campaign. It was not a single isolated breach or a simple phishing incident. The attackers combined a range of techniques, including social engineering by fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise, and an advanced transaction-authorisation method.June 2026 — Supply chain attack. Engineer A from Wallet DevOps downloaded a tampered Homebrew installation in order to install a popular AI coding tool after searching for it on a search engine. Our security team detected the anomaly, replaced the device, and rotated all related credentials as a proactive security action. However, Engineer A’s role and his related colleagues on our wallet infrastructure team was exposed to the hacker. Throughout 2026, Binance's security team detected and prevented 57 suspected North Korea-linked cyber threat cases. These attempts reflect the persistent threat posed by state-sponsored actors targeting the cryptocurrency industry. The techniques include fraudulent job interviews, malicious software disguised as popular developer tools, compromised software packages and browser extensions, fake video conferencing applications, and social engineering campaigns designed to steal credentials or deploy remote access malware.September 2026 — social engineering. Software Engineer B was contacted through a legitimate job-hunting platform by an individual posing as a Project Director. Software Engineer B had a profile on the platform that referenced his experience at Binance. The purported Project Director arranged a first-round interview with a HR representative, followed by a second-round interview with an individual claiming to be the CEO of a fictitious company.In the first round, the purported HR representative conducted a live video interview with Software Engineer B. The interviewer shared a social media account with him, including personal photos and videos posted on the platform, in order to build trust. This was more advanced and deceptive than previously seen social engineering approaches. The second interview was conducted in a popular social chat app, near the end of the interview, Engineer B was instructed to download an “assignment” containing a malicious code repository onto his work computer. The repository contained malicious code that executed during the setup process, initiating a series of unauthorized activities.The malware employed sophisticated obfuscation and evasion techniques, including replacing a legitimate development tool component with a malicious version to execute commands and establish communication with an attacker-controlled external server. The 0-day malware was not detected by the endpoint security protection tools at the time. The attacker also took steps to conceal the malicious activity and remove traces of the compromise, making detection and subsequent investigation more challenging.The script executed the below steps by applying obfuscation techniques to evade security detection.CREATE /opt/homebrew/Cellar/pyenv/2.8.0/libexec/pyenv_ MODIFY pyenv_ → 3,414 B DELETE .../libexec/pyenv (3,344 B) ← remove the valid pyenvRENAME pyenv_ → pyenv (3,414 B) ← replace it with a malicious version DELETE /opt/homebrew/bin/pyenv (3,414 B)ln (create a new symlink) + spawn zsh20 October, 2026 — use of an internal AI tool as a springboard. The attacker leveraged the compromised computer of engineer B and used an internal AI tool to gain control over the Wallet DevOps Engineer A and another Wallet Software Engineer C. The attacker soon discovered Wallet DevOps Engineer A had a container deployment permission token on his computer.29 October, 2026 — reach into wallet signing operations. On 29 October between 17:15 and 19:56, the attacker logged onto Software Engineer C’s computer, used the credentials stolen from Wallet DevOps Engineer A, deployed a container, and triggered a malicious script to launch the attack.What we have doneAs of Nov 3, 2026, we have taken the following actions:Rebuilt the affected wallet system in a new environment.Rebuilt the affected internal AI tool and access controls.Replaced affected devices.Decommissioned credentials and tokens related to affected engineers.Completed enhanced security scans across all employee devices.Enhanced AI-based behavioural anomaly detection.Strengthened wallet-service risk controls.Worked with law enforcement, blockchain intelligence firms and industry partners to trace and freeze affected assets.We will continue to strengthen our measures as the investigation progresses. There are a number of security measures we have implemented and are implementing that will remain private to prevent malicious actors from compromising our security.Further actionsWe are taking the following steps immediately.1. Independent cybersecurity reviewWe are engaging independent third-party cybersecurity experts to conduct a comprehensive review of the incident, validate our findings and recommend additional measures. The scope and findings of that review will inform our continuing remediation work.2. Expanded investment in AI security and preventionWe are increasing investment in AI-enabled detection, endpoint protection, developer-environment security and behavioural anomaly monitoring.3. Security research fund and industry initiativesWe are working on establishing a security research fund and targeted initiatives with leading AI companies, industry participants and security firms focused on AI security in blockchain environments.We will continue to proactively share information as and when we have it.
23
🚨 THE INCIDENT EQUATION: Anatomy of a Breach 🚨
#binanceincidentreport
The initial findings are officially out. Let’s break down the root cause using pure logic 🧮👇
(Social Engineering) + (Compromised AI Tools) = Multistage Exploit 🛑
The Input:
(The Findings) = Binance just released its preliminary report, and the FBI has officially attributed the Oct 29 attack to North Korea’s state-sponsored hackers.
The Deliverable:
(The Anatomy) ➔ This wasn’t a simple private key leak. Attackers executed a complex multistage campaign involving social engineering and compromised internal AI tooling. Stolen credentials were then leveraged to deploy a rogue container that authorized the massive withdrawals.
The Breakdown:
The threat is completely neutralized. Affected systems are rebuilt, devices replaced, and compromised credentials revoked. With user balances 100% backed and covered by Binance, this sophisticated attack serves as a massive wake-up call for the entire crypto industry.
Will this historic breach force Web3 to completely rethink internal exchange security? ❓👇💬
$BTC
{future}(BTCUSDT)
$ETH
{future}(ETHUSDT)
$BNB
{future}(BNBUSDT)
#Binance #CryptoSecurity #CryptoNews
🚨 THE INCIDENT EQUATION: Anatomy of a Breach 🚨
#binanceincidentreport
The initial findings are officially out. Let’s break down the root cause using pure logic 🧮👇
(Social Engineering) + (Compromised AI Tools) = Multistage Exploit 🛑
The Input:
(The Findings) = Binance just released its preliminary report, and the FBI has officially attributed the Oct 29 attack to North Korea’s state-sponsored hackers.
The Deliverable:
(The Anatomy) ➔ This wasn’t a simple private key leak. Attackers executed a complex multistage campaign involving social engineering and compromised internal AI tooling. Stolen credentials were then leveraged to deploy a rogue container that authorized the massive withdrawals.
The Breakdown:
The threat is completely neutralized. Affected systems are rebuilt, devices replaced, and compromised credentials revoked. With user balances 100% backed and covered by Binance, this sophisticated attack serves as a massive wake-up call for the entire crypto industry.
Will this historic breach force Web3 to completely rethink internal exchange security? ❓👇💬
$BTC
$ETH
$BNB
#Binance #CryptoSecurity #CryptoNews
#binanceincidentreport
The initial findings are officially out. Let’s break down the root cause using pure logic 🧮👇
(Social Engineering) + (Compromised AI Tools) = Multistage Exploit 🛑
The Input:
(The Findings) = Binance just released its preliminary report, and the FBI has officially attributed the Oct 29 attack to North Korea’s state-sponsored hackers.
The Deliverable:
(The Anatomy) ➔ This wasn’t a simple private key leak. Attackers executed a complex multistage campaign involving social engineering and compromised internal AI tooling. Stolen credentials were then leveraged to deploy a rogue container that authorized the massive withdrawals.
The Breakdown:
The threat is completely neutralized. Affected systems are rebuilt, devices replaced, and compromised credentials revoked. With user balances 100% backed and covered by Binance, this sophisticated attack serves as a massive wake-up call for the entire crypto industry.
Will this historic breach force Web3 to completely rethink internal exchange security? ❓👇💬
$BTC
$ETH
$BNB
#Binance #CryptoSecurity #CryptoNews
106
#BinanceIncidentReport
A Binance withdrawal freeze could not revoke an on-chain permission that was still moving funds.
The key detail in Binance’s November 3 initial report is not the $6.34B impact: attackers used EIP-7702 to delegate execution rights from a Binance hot wallet to an attacker-controlled contract. Binance says this happened through its internal signing service, outside the normal withdrawal path.
That distinction matters. A normal withdrawal pause blocks the exchange’s ordinary transfer workflow. But EIP-7702 writes a delegation indicator into an account’s on-chain code, and Ethereum’s specification makes that delegation persistent until it is explicitly cleared. Shutting down the wallet service therefore does not, by itself, remove authority already recorded on-chain.
Binance says it needed additional transactions to revoke those permissions. The hot wallet used multi-party computation (MPC), so there was no single private key available for an immediate reversal; a specialized revocation procedure was required. The report records the final unauthorized transfer at 23:56 UTC on October 29, with the Binance14 delegation cleared at 00:10 UTC on October 30.
This does not mean EIP-7702 is inherently unsafe; the standard enables useful account functionality. The overlooked issue is operational: once powerful authorization is committed on-chain, incident response must include revocation at the protocol layer—not only disabling internal services.
The unresolved test for Binance’s independent review is whether its signing policies can prevent unauthorized delegation and whether the MPC revocation path can be executed quickly under pressure.
#BinanceIncidentReport
A Binance withdrawal freeze could not revoke an on-chain permission that was still moving funds.
The key detail in Binance’s November 3 initial report is not the $6.34B impact: attackers used EIP-7702 to delegate execution rights from a Binance hot wallet to an attacker-controlled contract. Binance says this happened through its internal signing service, outside the normal withdrawal path.
That distinction matters. A normal withdrawal pause blocks the exchange’s ordinary transfer workflow. But EIP-7702 writes a delegation indicator into an account’s on-chain code, and Ethereum’s specification makes that delegation persistent until it is explicitly cleared. Shutting down the wallet service therefore does not, by itself, remove authority already recorded on-chain.
Binance says it needed additional transactions to revoke those permissions. The hot wallet used multi-party computation (MPC), so there was no single private key available for an immediate reversal; a specialized revocation procedure was required. The report records the final unauthorized transfer at 23:56 UTC on October 29, with the Binance14 delegation cleared at 00:10 UTC on October 30.
This does not mean EIP-7702 is inherently unsafe; the standard enables useful account functionality. The overlooked issue is operational: once powerful authorization is committed on-chain, incident response must include revocation at the protocol layer—not only disabling internal services.
The unresolved test for Binance’s independent review is whether its signing policies can prevent unauthorized delegation and whether the MPC revocation path can be executed quickly under pressure.
A Binance withdrawal freeze could not revoke an on-chain permission that was still moving funds.
The key detail in Binance’s November 3 initial report is not the $6.34B impact: attackers used EIP-7702 to delegate execution rights from a Binance hot wallet to an attacker-controlled contract. Binance says this happened through its internal signing service, outside the normal withdrawal path.
That distinction matters. A normal withdrawal pause blocks the exchange’s ordinary transfer workflow. But EIP-7702 writes a delegation indicator into an account’s on-chain code, and Ethereum’s specification makes that delegation persistent until it is explicitly cleared. Shutting down the wallet service therefore does not, by itself, remove authority already recorded on-chain.
Binance says it needed additional transactions to revoke those permissions. The hot wallet used multi-party computation (MPC), so there was no single private key available for an immediate reversal; a specialized revocation procedure was required. The report records the final unauthorized transfer at 23:56 UTC on October 29, with the Binance14 delegation cleared at 00:10 UTC on October 30.
This does not mean EIP-7702 is inherently unsafe; the standard enables useful account functionality. The overlooked issue is operational: once powerful authorization is committed on-chain, incident response must include revocation at the protocol layer—not only disabling internal services.
The unresolved test for Binance’s independent review is whether its signing policies can prevent unauthorized delegation and whether the MPC revocation path can be executed quickly under pressure.
76
·
--
#BinanceIncidentReport
🚨 JUST IN: Binance Incident Report Is Out — Here's The Full Truth!
Binance has released its initial findings on the 29 Oct hack and the numbers are insane:
💥 $6.34B was affected — but 98% already replenished as of Oct 31!
❄️ $2.85B frozen with help from Tether & Circle — hackers trapped
🛡️ SAFU fund covering ALL losses — Zero impact on users
🔐 No private key leak — User funds remain 100% safe
Binance confirmed it was a multi-stage sophisticated attack via compromised DevOps infrastructure, and said "this should not have happened" — now systems are hardened and FBI investigation is ongoing.
With 98% funds restored, is Binance proving why it's still the most trusted exchange?
Drop your thoughts below 👇
#Binance #BinanceHack #SAFU #BTC
@Square-Creator-314483822eb83 @heyi
$BNX $BTC $ETH
{future}(ETHUSDT)
#BinanceIncidentReport
🚨 JUST IN: Binance Incident Report Is Out — Here's The Full Truth!
Binance has released its initial findings on the 29 Oct hack and the numbers are insane:
💥 $6.34B was affected — but 98% already replenished as of Oct 31!
❄️ $2.85B frozen with help from Tether & Circle — hackers trapped
🛡️ SAFU fund covering ALL losses — Zero impact on users
🔐 No private key leak — User funds remain 100% safe
Binance confirmed it was a multi-stage sophisticated attack via compromised DevOps infrastructure, and said "this should not have happened" — now systems are hardened and FBI investigation is ongoing.
With 98% funds restored, is Binance proving why it's still the most trusted exchange?
Drop your thoughts below 👇
#Binance #BinanceHack #SAFU #BTC
@Golden soumi @Yi He
$BNX $BTC $ETH
🚨 JUST IN: Binance Incident Report Is Out — Here's The Full Truth!
Binance has released its initial findings on the 29 Oct hack and the numbers are insane:
💥 $6.34B was affected — but 98% already replenished as of Oct 31!
❄️ $2.85B frozen with help from Tether & Circle — hackers trapped
🛡️ SAFU fund covering ALL losses — Zero impact on users
🔐 No private key leak — User funds remain 100% safe
Binance confirmed it was a multi-stage sophisticated attack via compromised DevOps infrastructure, and said "this should not have happened" — now systems are hardened and FBI investigation is ongoing.
With 98% funds restored, is Binance proving why it's still the most trusted exchange?
Drop your thoughts below 👇
#Binance #BinanceHack #SAFU #BTC
@Golden soumi @Yi He
$BNX $BTC $ETH
85
·
--
Article
BINANCE INCIDENT REPORT: A $6.3 BILLION SECURITY SHOCK AND A MAJOR TEST OF TRUST🚨 The biggest question after a major crypto security incident is not just how much was lost — it is whether users can trust the platform again.
Binance has faced a serious security incident involving unauthorized withdrawals from its hot wallets, with approximately $6.3 billion in tokenized assets reportedly impacted. The incident has triggered a major security investigation, emergency recovery efforts, and renewed discussions about centralized exchange security.
But the response is just as important as the incident itself.
🔍 What Happened?
Binance's initial investigation indicated that a compromised employee device may have played a role in the attack. Further investigation uncovered additional points of compromise, while Binance stated that it had found no evidence of wallet private keys being leaked.
The company has been working with law enforcement, blockchain intelligence firms, token issuers, and industry partners to trace and freeze affected assets.
💰 How Is Binance Responding?
Binance has committed to absorbing the financial impact of the incident rather than passing the losses to users. Its recovery efforts have included:
• Replenishing affected assets through company funds and SAFU resources
• Tracing and freezing stolen assets with industry partners
• Strengthening security controls across affected infrastructure
• Restoring withdrawals in phases after security checks
• Improving transparency through Proof of Reserves
• Preparing a comprehensive technical post-incident report
According to Binance's November 1 recovery update, approximately 95% of the impacted amount had been covered, with the remaining assets still being sourced.
⚠️ The Bigger Lesson for Crypto Investors
This incident highlights an important reality: even major exchanges can face serious security risks.
Investors should avoid relying entirely on exchange reputation. Strong account security, withdrawal protections, hardware wallets for long-term holdings, and independent verification of platform reserves are all important parts of managing crypto risk.
Binance's recovery progress is encouraging, but the full technical report will be crucial for understanding how the attack happened and what safeguards will prevent a repeat.
The real test is not simply recovering the funds — it is proving that the security infrastructure is stronger afterward.
What matters most to you after a major exchange security incident: full compensation, transparent reporting, or stronger security systems?
#binanceincidentreport $BNB
{spot}(BNBUSDT)
BINANCE INCIDENT REPORT: A $6.3 BILLION SECURITY SHOCK AND A MAJOR TEST OF TRUST
🚨 The biggest question after a major crypto security incident is not just how much was lost — it is whether users can trust the platform again.
Binance has faced a serious security incident involving unauthorized withdrawals from its hot wallets, with approximately $6.3 billion in tokenized assets reportedly impacted. The incident has triggered a major security investigation, emergency recovery efforts, and renewed discussions about centralized exchange security.
But the response is just as important as the incident itself.
🔍 What Happened?
Binance's initial investigation indicated that a compromised employee device may have played a role in the attack. Further investigation uncovered additional points of compromise, while Binance stated that it had found no evidence of wallet private keys being leaked.
The company has been working with law enforcement, blockchain intelligence firms, token issuers, and industry partners to trace and freeze affected assets.
💰 How Is Binance Responding?
Binance has committed to absorbing the financial impact of the incident rather than passing the losses to users. Its recovery efforts have included:
• Replenishing affected assets through company funds and SAFU resources
• Tracing and freezing stolen assets with industry partners
• Strengthening security controls across affected infrastructure
• Restoring withdrawals in phases after security checks
• Improving transparency through Proof of Reserves
• Preparing a comprehensive technical post-incident report
According to Binance's November 1 recovery update, approximately 95% of the impacted amount had been covered, with the remaining assets still being sourced.
⚠️ The Bigger Lesson for Crypto Investors
This incident highlights an important reality: even major exchanges can face serious security risks.
Investors should avoid relying entirely on exchange reputation. Strong account security, withdrawal protections, hardware wallets for long-term holdings, and independent verification of platform reserves are all important parts of managing crypto risk.
Binance's recovery progress is encouraging, but the full technical report will be crucial for understanding how the attack happened and what safeguards will prevent a repeat.
The real test is not simply recovering the funds — it is proving that the security infrastructure is stronger afterward.
What matters most to you after a major exchange security incident: full compensation, transparent reporting, or stronger security systems?
#binanceincidentreport $BNB
Binance has faced a serious security incident involving unauthorized withdrawals from its hot wallets, with approximately $6.3 billion in tokenized assets reportedly impacted. The incident has triggered a major security investigation, emergency recovery efforts, and renewed discussions about centralized exchange security.
But the response is just as important as the incident itself.
🔍 What Happened?
Binance's initial investigation indicated that a compromised employee device may have played a role in the attack. Further investigation uncovered additional points of compromise, while Binance stated that it had found no evidence of wallet private keys being leaked.
The company has been working with law enforcement, blockchain intelligence firms, token issuers, and industry partners to trace and freeze affected assets.
💰 How Is Binance Responding?
Binance has committed to absorbing the financial impact of the incident rather than passing the losses to users. Its recovery efforts have included:
• Replenishing affected assets through company funds and SAFU resources
• Tracing and freezing stolen assets with industry partners
• Strengthening security controls across affected infrastructure
• Restoring withdrawals in phases after security checks
• Improving transparency through Proof of Reserves
• Preparing a comprehensive technical post-incident report
According to Binance's November 1 recovery update, approximately 95% of the impacted amount had been covered, with the remaining assets still being sourced.
⚠️ The Bigger Lesson for Crypto Investors
This incident highlights an important reality: even major exchanges can face serious security risks.
Investors should avoid relying entirely on exchange reputation. Strong account security, withdrawal protections, hardware wallets for long-term holdings, and independent verification of platform reserves are all important parts of managing crypto risk.
Binance's recovery progress is encouraging, but the full technical report will be crucial for understanding how the attack happened and what safeguards will prevent a repeat.
The real test is not simply recovering the funds — it is proving that the security infrastructure is stronger afterward.
What matters most to you after a major exchange security incident: full compensation, transparent reporting, or stronger security systems?
#binanceincidentreport $BNB
59
·
--
#BinanceIncidentReport
🎣 A Fake Job Interview Opened the Door to a $6.3B Heist
Binance's first incident report says the Oct 29 theft began with compromised employee laptops, not flawed blockchain code.
📅 June: a wallet engineer installed a tampered coding tool
💼 September: a second engineer fell for a fake recruiter
⏱️ Oct 29: funds left 20:05 UTC; contained by 00:10 UTC
🏦 About $2.85B frozen; 98% of affected tokens replenished
Zoom out: the weak link was people and tools, not code. Binance says it blocked 57 suspected DPRK-linked attempts this year.
Does this report rebuild your trust in exchange security? 👇
$BNB $ETH
#BinanceIncidentReport #CryptoSecurity #CryptoNews
#BinanceIncidentReport
🎣 A Fake Job Interview Opened the Door to a $6.3B Heist
Binance's first incident report says the Oct 29 theft began with compromised employee laptops, not flawed blockchain code.
📅 June: a wallet engineer installed a tampered coding tool
💼 September: a second engineer fell for a fake recruiter
⏱️ Oct 29: funds left 20:05 UTC; contained by 00:10 UTC
🏦 About $2.85B frozen; 98% of affected tokens replenished
Zoom out: the weak link was people and tools, not code. Binance says it blocked 57 suspected DPRK-linked attempts this year.
Does this report rebuild your trust in exchange security? 👇
$BNB $ETH
#BinanceIncidentReport #CryptoSecurity #CryptoNews
🎣 A Fake Job Interview Opened the Door to a $6.3B Heist
Binance's first incident report says the Oct 29 theft began with compromised employee laptops, not flawed blockchain code.
📅 June: a wallet engineer installed a tampered coding tool
💼 September: a second engineer fell for a fake recruiter
⏱️ Oct 29: funds left 20:05 UTC; contained by 00:10 UTC
🏦 About $2.85B frozen; 98% of affected tokens replenished
Zoom out: the weak link was people and tools, not code. Binance says it blocked 57 suspected DPRK-linked attempts this year.
Does this report rebuild your trust in exchange security? 👇
$BNB $ETH
#BinanceIncidentReport #CryptoSecurity #CryptoNews
31
Article
TraderTraitor (Lazarus Group) exploit of Binance🚨 The FBI, U.S. Secret Service,& blockchain intelligence firms (such as Chainalysis and TRM Labs) released detailed technical tracking data and wallet addresses linked to TraderTraitor (Lazarus Group) exploit of Binance 🔍.
Due to massive size of breach 💸, FBI placed over 600 total addresses on its global blocking advisory 🛑 to prevent laundering through exchanges & instant swaps 💱.
Primary initial addresses & consolidation targets on Ethereum & Bitcoin 🔗:
🛡️ Key Attacker Infrastructure Addresses
1️⃣ Ethereum Primary Destination Wallets ⚡
Primary Sweeper Destination Wallet: 📥
0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c
📝 Details: The primary landing address used during the initial EIP-7702 atomic sweep of Binance's Ethereum hot wallets. It held 971.1 Million USDT and 823 Million USDC before Tether and Circle executed emergency smart-contract freezes 🧊.
Secondary Staging/Consolidation Wallet: 🗄️
0x8532FA14ACAf483729C449b8458aedDb900543D4
📝 Details: Received approximately 195,460 ETH transferred from the primary receiving address at 20:38 UTC on October 29. Labeled as Binance Hot Wallet Exploiter 8 across major block explorers 🌐.
2️⃣ Bitcoin Primary Receiving & Peel Chain Hubs 🪙
Primary Consolidation Hub: 🧱
bc1q9d8k3x2mzp8a4hlylh52h4k2u99pvhv9g70h6q
Secondary UTXO Splitting Address: 🔀
bc1qw508d6qqjhymd25400ee8f0269d15029514354
📝 Details: Used by TraderTraitor to split the 18,270 stolen BTC into smaller 1,000 BTC and 100 BTC "peel chains" across automated wallet layers 🔄.
3️⃣ XRP & Tron Primary Outflow Destinations 🌊
XRP Ledger Receiving Address: 💧
rHb9CJAWyB4rj91VRWn96Dkukr4bwdtyTh (Consolidated 233.46 Million XRP from five Binance hot wallets).
Tron Main Destination Address: 🚀
TQn9Y2khEsLJW1ChVWFMSMeRDow5KcbLSE (Held 612.7 Million USDT prior to frozen state).
🕵️♂️ Public Verification & Monitoring
Because on-chain tracking continuously updates as funds move or get frozen by security protocols 🔒:
📂 The full dataset of 620+ associated address hashes is available directly in the FBI Cyber Advisory Release (October 31, 2026) 📑.
🔍 Public explorers like Etherscan and Blockchain.com tag these addresses under the uniform entity filter label: Binance Exploiter (TraderTraitor / DPRK) 🏷️.
$BNB $USDT $BTC
{spot}(BTCUSDT)
{spot}(BNBUSDT)
{spot}(ETHUSDT)
#BinanceIncidentReport #HackerAlert #BinanceSquareTalks #TrendingTopic #CZ
TraderTraitor (Lazarus Group) exploit of Binance
🚨 The FBI, U.S. Secret Service,& blockchain intelligence firms (such as Chainalysis and TRM Labs) released detailed technical tracking data and wallet addresses linked to TraderTraitor (Lazarus Group) exploit of Binance 🔍.
Due to massive size of breach 💸, FBI placed over 600 total addresses on its global blocking advisory 🛑 to prevent laundering through exchanges & instant swaps 💱.
Primary initial addresses & consolidation targets on Ethereum & Bitcoin 🔗:
🛡️ Key Attacker Infrastructure Addresses
1️⃣ Ethereum Primary Destination Wallets ⚡
Primary Sweeper Destination Wallet: 📥
0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c
📝 Details: The primary landing address used during the initial EIP-7702 atomic sweep of Binance's Ethereum hot wallets. It held 971.1 Million USDT and 823 Million USDC before Tether and Circle executed emergency smart-contract freezes 🧊.
Secondary Staging/Consolidation Wallet: 🗄️
0x8532FA14ACAf483729C449b8458aedDb900543D4
📝 Details: Received approximately 195,460 ETH transferred from the primary receiving address at 20:38 UTC on October 29. Labeled as Binance Hot Wallet Exploiter 8 across major block explorers 🌐.
2️⃣ Bitcoin Primary Receiving & Peel Chain Hubs 🪙
Primary Consolidation Hub: 🧱
bc1q9d8k3x2mzp8a4hlylh52h4k2u99pvhv9g70h6q
Secondary UTXO Splitting Address: 🔀
bc1qw508d6qqjhymd25400ee8f0269d15029514354
📝 Details: Used by TraderTraitor to split the 18,270 stolen BTC into smaller 1,000 BTC and 100 BTC "peel chains" across automated wallet layers 🔄.
3️⃣ XRP & Tron Primary Outflow Destinations 🌊
XRP Ledger Receiving Address: 💧
rHb9CJAWyB4rj91VRWn96Dkukr4bwdtyTh (Consolidated 233.46 Million XRP from five Binance hot wallets).
Tron Main Destination Address: 🚀
TQn9Y2khEsLJW1ChVWFMSMeRDow5KcbLSE (Held 612.7 Million USDT prior to frozen state).
🕵️♂️ Public Verification & Monitoring
Because on-chain tracking continuously updates as funds move or get frozen by security protocols 🔒:
📂 The full dataset of 620+ associated address hashes is available directly in the FBI Cyber Advisory Release (October 31, 2026) 📑.
🔍 Public explorers like Etherscan and Blockchain.com tag these addresses under the uniform entity filter label: Binance Exploiter (TraderTraitor / DPRK) 🏷️.
$BNB $USDT $BTC
#BinanceIncidentReport #HackerAlert #BinanceSquareTalks #TrendingTopic #CZ
Due to massive size of breach 💸, FBI placed over 600 total addresses on its global blocking advisory 🛑 to prevent laundering through exchanges & instant swaps 💱.
Primary initial addresses & consolidation targets on Ethereum & Bitcoin 🔗:
🛡️ Key Attacker Infrastructure Addresses
1️⃣ Ethereum Primary Destination Wallets ⚡
Primary Sweeper Destination Wallet: 📥
0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c
📝 Details: The primary landing address used during the initial EIP-7702 atomic sweep of Binance's Ethereum hot wallets. It held 971.1 Million USDT and 823 Million USDC before Tether and Circle executed emergency smart-contract freezes 🧊.
Secondary Staging/Consolidation Wallet: 🗄️
0x8532FA14ACAf483729C449b8458aedDb900543D4
📝 Details: Received approximately 195,460 ETH transferred from the primary receiving address at 20:38 UTC on October 29. Labeled as Binance Hot Wallet Exploiter 8 across major block explorers 🌐.
2️⃣ Bitcoin Primary Receiving & Peel Chain Hubs 🪙
Primary Consolidation Hub: 🧱
bc1q9d8k3x2mzp8a4hlylh52h4k2u99pvhv9g70h6q
Secondary UTXO Splitting Address: 🔀
bc1qw508d6qqjhymd25400ee8f0269d15029514354
📝 Details: Used by TraderTraitor to split the 18,270 stolen BTC into smaller 1,000 BTC and 100 BTC "peel chains" across automated wallet layers 🔄.
3️⃣ XRP & Tron Primary Outflow Destinations 🌊
XRP Ledger Receiving Address: 💧
rHb9CJAWyB4rj91VRWn96Dkukr4bwdtyTh (Consolidated 233.46 Million XRP from five Binance hot wallets).
Tron Main Destination Address: 🚀
TQn9Y2khEsLJW1ChVWFMSMeRDow5KcbLSE (Held 612.7 Million USDT prior to frozen state).
🕵️♂️ Public Verification & Monitoring
Because on-chain tracking continuously updates as funds move or get frozen by security protocols 🔒:
📂 The full dataset of 620+ associated address hashes is available directly in the FBI Cyber Advisory Release (October 31, 2026) 📑.
🔍 Public explorers like Etherscan and Blockchain.com tag these addresses under the uniform entity filter label: Binance Exploiter (TraderTraitor / DPRK) 🏷️.
$BNB $USDT $BTC
#BinanceIncidentReport #HackerAlert #BinanceSquareTalks #TrendingTopic #CZ
1
86
·
--
Bullish
🚨 BINANCE PUBLISHES DETAILED FINDINGS ON OCT 29 SECURITY INCIDENT! 🛡️⚡
$6.34B Total Impact & 100% SAFU Coverage: Approximately $6.34B in digital assets were targeted, with over $2.85B frozen/intercepted. Binance is absorbing all losses, ensuring zero user loss with 98%+ of assets already replenished on Proof of Reserves!
Attacker Identified: The FBI's latest investigation attributes the sophisticated, multi-stage cyberattack to state-sponsored actors from the DPRK (North Korea).
Complex Attack Vector: Attackers combined social engineering (fake job interviews), malicious software downloads, compromised developer devices, and exploited Ethereum's EIP-7702 delegation mechanism to bypass standard signing paths.
Full Containment & Hardening: All entry points were closed, compromised systems replaced/rebuilt, and authorization delegations cleared (via zero-address delegation reset at 00:10 UTC, Oct 30).
Enhanced Security Measures: Rebuilt affected AI/wallet tools, engaged independent cybersecurity firms, expanded AI-based anomaly detection, and launching an industry AI-blockchain security research fund!
💬 YOUR TURN: How do you view Binance's transparency, total financial backing, and rapid $2.85B asset freeze response?
👇 Drop your thoughts below!
"CLICK ON THE BELOW YELLOW COIN TAG TO GO TO DESIRED TRADING PAGE TO GET BENEFIT TRADE" $BTC
{future}(BTCUSDT)
$BNB
{future}(BNBUSDT)
$SOL
{future}(SOLUSDT)
$XRP#BinanceIncidentReport
#BinanceHourlyDepositsExceedWithdrawals #AppleReportsMixedResults #Binance
🚨 BINANCE PUBLISHES DETAILED FINDINGS ON OCT 29 SECURITY INCIDENT! 🛡️⚡
$6.34B Total Impact & 100% SAFU Coverage: Approximately $6.34B in digital assets were targeted, with over $2.85B frozen/intercepted. Binance is absorbing all losses, ensuring zero user loss with 98%+ of assets already replenished on Proof of Reserves!
Attacker Identified: The FBI's latest investigation attributes the sophisticated, multi-stage cyberattack to state-sponsored actors from the DPRK (North Korea).
Complex Attack Vector: Attackers combined social engineering (fake job interviews), malicious software downloads, compromised developer devices, and exploited Ethereum's EIP-7702 delegation mechanism to bypass standard signing paths.
Full Containment & Hardening: All entry points were closed, compromised systems replaced/rebuilt, and authorization delegations cleared (via zero-address delegation reset at 00:10 UTC, Oct 30).
Enhanced Security Measures: Rebuilt affected AI/wallet tools, engaged independent cybersecurity firms, expanded AI-based anomaly detection, and launching an industry AI-blockchain security research fund!
💬 YOUR TURN: How do you view Binance's transparency, total financial backing, and rapid $2.85B asset freeze response?
👇 Drop your thoughts below!
"CLICK ON THE BELOW YELLOW COIN TAG TO GO TO DESIRED TRADING PAGE TO GET BENEFIT TRADE" $BTC
$BNB
$SOL
$XRP#BinanceIncidentReport
#BinanceHourlyDepositsExceedWithdrawals #AppleReportsMixedResults #Binance
$6.34B Total Impact & 100% SAFU Coverage: Approximately $6.34B in digital assets were targeted, with over $2.85B frozen/intercepted. Binance is absorbing all losses, ensuring zero user loss with 98%+ of assets already replenished on Proof of Reserves!
Attacker Identified: The FBI's latest investigation attributes the sophisticated, multi-stage cyberattack to state-sponsored actors from the DPRK (North Korea).
Complex Attack Vector: Attackers combined social engineering (fake job interviews), malicious software downloads, compromised developer devices, and exploited Ethereum's EIP-7702 delegation mechanism to bypass standard signing paths.
Full Containment & Hardening: All entry points were closed, compromised systems replaced/rebuilt, and authorization delegations cleared (via zero-address delegation reset at 00:10 UTC, Oct 30).
Enhanced Security Measures: Rebuilt affected AI/wallet tools, engaged independent cybersecurity firms, expanded AI-based anomaly detection, and launching an industry AI-blockchain security research fund!
💬 YOUR TURN: How do you view Binance's transparency, total financial backing, and rapid $2.85B asset freeze response?
👇 Drop your thoughts below!
"CLICK ON THE BELOW YELLOW COIN TAG TO GO TO DESIRED TRADING PAGE TO GET BENEFIT TRADE" $BTC
$BNB
$SOL
$XRP#BinanceIncidentReport
#BinanceHourlyDepositsExceedWithdrawals #AppleReportsMixedResults #Binance
1
99
·
--
Bearish
The biggest lesson from #BinanceIncidentReport is that modern cyberattacks rarely start with code. They often start with trust, social engineering, and human error.
Despite the scale of the attack, Binance's commitment to covering user losses, strengthening security, and sharing lessons with the industry is a positive step toward a safer crypto ecosystem.
Security awareness remains everyone's responsibility. 🛡️
$ETH
{future}(ETHUSDT)
{future}(SOLUSDT)
{future}(BTCUSDT)
The biggest lesson from #BinanceIncidentReport is that modern cyberattacks rarely start with code. They often start with trust, social engineering, and human error.
Despite the scale of the attack, Binance's commitment to covering user losses, strengthening security, and sharing lessons with the industry is a positive step toward a safer crypto ecosystem.
Security awareness remains everyone's responsibility. 🛡️
$ETH
Despite the scale of the attack, Binance's commitment to covering user losses, strengthening security, and sharing lessons with the industry is a positive step toward a safer crypto ecosystem.
Security awareness remains everyone's responsibility. 🛡️
$ETH
102
#BinanceIncidentReport
🚨 BINANCE COMPLETES NEW PROOF OF RESERVES AFTER $6B+ HACK!
Binance is moving forward with recovery as it works to restore user confidence and withdrawals.
📊 Key Updates:
✅ New Proof of Reserves completed for 10 major assets.
✅ Users can independently verify 1:1 asset backing.
✅ Binance says approximately 95% of affected assets have been replenished.
✅ Remaining 5% recovery is still underway.
✅ Additional withdrawal networks expected to reopen progressively from Tuesday.
✅ Another reserves snapshot planned for Wednesday.
🔥 The recovery continues, but transparency and security remain critical.
Can Binance fully restore user confidence?
💬 What do you think?
#Binance #CryptoSecurity #ProofOfReserves #Bitcoin
#BinanceIncidentReport
🚨 BINANCE COMPLETES NEW PROOF OF RESERVES AFTER $6B+ HACK!
Binance is moving forward with recovery as it works to restore user confidence and withdrawals.
📊 Key Updates:
✅ New Proof of Reserves completed for 10 major assets.
✅ Users can independently verify 1:1 asset backing.
✅ Binance says approximately 95% of affected assets have been replenished.
✅ Remaining 5% recovery is still underway.
✅ Additional withdrawal networks expected to reopen progressively from Tuesday.
✅ Another reserves snapshot planned for Wednesday.
🔥 The recovery continues, but transparency and security remain critical.
Can Binance fully restore user confidence?
💬 What do you think?
#Binance #CryptoSecurity #ProofOfReserves #Bitcoin
🚨 BINANCE COMPLETES NEW PROOF OF RESERVES AFTER $6B+ HACK!
Binance is moving forward with recovery as it works to restore user confidence and withdrawals.
📊 Key Updates:
✅ New Proof of Reserves completed for 10 major assets.
✅ Users can independently verify 1:1 asset backing.
✅ Binance says approximately 95% of affected assets have been replenished.
✅ Remaining 5% recovery is still underway.
✅ Additional withdrawal networks expected to reopen progressively from Tuesday.
✅ Another reserves snapshot planned for Wednesday.
🔥 The recovery continues, but transparency and security remain critical.
Can Binance fully restore user confidence?
💬 What do you think?
#Binance #CryptoSecurity #ProofOfReserves #Bitcoin
1
53
#BinanceIncidentReport 🚨 BINANCE $6.34B HACK UPDATE
Binance reports that 98% of affected assets have been replenished, while approximately $2.85B was reportedly frozen.
The exchange says users will not bear the financial losses. Withdrawals are gradually resuming.
🛡️ Crypto security remains critical.
#Binance #CryptoNews #Security
🚨 CRYPTO FUTURES UPDATE: IRYS & PIEVERSE LEAD THE RALLY!
Binance Futures is seeing strong momentum across selected altcoins.
📈 LATEST MARKET PERFORMANCE:
🔥 IRYS: $0.02222 | +16.21%
🚀 PIEVERSE: $1.1681 | +11.68%
📊 UVXY: +8.05% (previously reported)
🔥 MARKET HIGHLIGHTS:
IRYS leads with the strongest reported gain.
PIEVERSE maintains bullish momentum.
UVXY also records positive performance.
⚠️ MARKET WATCH: Watch trading volume, RSI and EMA 9/21. Strong rallies can reverse quickly.
🏆 QUESTION: Which token will lead the next rally — IRYS or PIEVERSE?
Not financial advice. Trade responsibly.
#Binance #CryptoNews #IRYS #PIEVERSE #UVXY #Altcoins #FuturesTrading
#BinanceIncidentReport 🚨 BINANCE $6.34B HACK UPDATE
Binance reports that 98% of affected assets have been replenished, while approximately $2.85B was reportedly frozen.
The exchange says users will not bear the financial losses. Withdrawals are gradually resuming.
🛡️ Crypto security remains critical.
#Binance #CryptoNews #Security
🚨 CRYPTO FUTURES UPDATE: IRYS & PIEVERSE LEAD THE RALLY!
Binance Futures is seeing strong momentum across selected altcoins.
📈 LATEST MARKET PERFORMANCE:
🔥 IRYS: $0.02222 | +16.21%
🚀 PIEVERSE: $1.1681 | +11.68%
📊 UVXY: +8.05% (previously reported)
🔥 MARKET HIGHLIGHTS:
IRYS leads with the strongest reported gain.
PIEVERSE maintains bullish momentum.
UVXY also records positive performance.
⚠️ MARKET WATCH: Watch trading volume, RSI and EMA 9/21. Strong rallies can reverse quickly.
🏆 QUESTION: Which token will lead the next rally — IRYS or PIEVERSE?
Not financial advice. Trade responsibly.
#Binance #CryptoNews #IRYS #PIEVERSE #UVXY #Altcoins #FuturesTrading
Binance reports that 98% of affected assets have been replenished, while approximately $2.85B was reportedly frozen.
The exchange says users will not bear the financial losses. Withdrawals are gradually resuming.
🛡️ Crypto security remains critical.
#Binance #CryptoNews #Security
🚨 CRYPTO FUTURES UPDATE: IRYS & PIEVERSE LEAD THE RALLY!
Binance Futures is seeing strong momentum across selected altcoins.
📈 LATEST MARKET PERFORMANCE:
🔥 IRYS: $0.02222 | +16.21%
🚀 PIEVERSE: $1.1681 | +11.68%
📊 UVXY: +8.05% (previously reported)
🔥 MARKET HIGHLIGHTS:
IRYS leads with the strongest reported gain.
PIEVERSE maintains bullish momentum.
UVXY also records positive performance.
⚠️ MARKET WATCH: Watch trading volume, RSI and EMA 9/21. Strong rallies can reverse quickly.
🏆 QUESTION: Which token will lead the next rally — IRYS or PIEVERSE?
Not financial advice. Trade responsibly.
#Binance #CryptoNews #IRYS #PIEVERSE #UVXY #Altcoins #FuturesTrading
189
·
--
Bullish
Long $ETH 165 USDT
⚡️UPDATE: $6.3 BILLION Binance hack began with a FAKE job interview.
An engineer downloaded a coding assignment containing malware onto his work computer after attackers posed as recruiters, per CoinDesk.
- Attackers later used an internal AI tool to reach two wallet engineers’ computers.
- Stolen credentials let them run a malicious script on October 29.
- They exploited $ETH Ethereum’s EIP-7702 feature to gain control over a hot wallet. Containment took about four hours.
Binance says $2.85 BILLION has been frozen and 98% of affected tokens replenished with company funds. Users will not bear the losses.
The FBI attributed the attack to North Korea.
#BinanceIncidentReport
#BinanceReopensWithdrawalsForMoreAssets
#USMidtermElections
⚡️UPDATE: $6.3 BILLION Binance hack began with a FAKE job interview.
An engineer downloaded a coding assignment containing malware onto his work computer after attackers posed as recruiters, per CoinDesk.
- Attackers later used an internal AI tool to reach two wallet engineers’ computers.
- Stolen credentials let them run a malicious script on October 29.
- They exploited $ETH Ethereum’s EIP-7702 feature to gain control over a hot wallet. Containment took about four hours.
Binance says $2.85 BILLION has been frozen and 98% of affected tokens replenished with company funds. Users will not bear the losses.
The FBI attributed the attack to North Korea.
#BinanceIncidentReport
#BinanceReopensWithdrawalsForMoreAssets
#USMidtermElections
An engineer downloaded a coding assignment containing malware onto his work computer after attackers posed as recruiters, per CoinDesk.
- Attackers later used an internal AI tool to reach two wallet engineers’ computers.
- Stolen credentials let them run a malicious script on October 29.
- They exploited $ETH Ethereum’s EIP-7702 feature to gain control over a hot wallet. Containment took about four hours.
Binance says $2.85 BILLION has been frozen and 98% of affected tokens replenished with company funds. Users will not bear the losses.
The FBI attributed the attack to North Korea.
#BinanceIncidentReport
#BinanceReopensWithdrawalsForMoreAssets
#USMidtermElections
464
·
--
Article
Official Binance Statement: Details of the Complex Technical Vulnerability and Steps to Secure the Remaining Assets 🔍The engineering and security teams outlined details of the intrusion and the ongoing digital forensic investigation: [[1](https://www.binance.com/en/support/announcement/detail/d3306d9dca5243548c813b605e1d1751)]
Multiple breach points: After initial findings indicated that a laptop belonging to a DevOps engineer had been targeted, subsequent in-depth investigations uncovered additional complex intrusion points and software protocols used by the attackers to route unauthorized transactions. [[1](https://www.binance.com/en/support/announcement/detail/d3306d9dca5243548c813b605e1d1751)]
Official Binance Statement: Details of the Complex Technical Vulnerability and Steps to Secure the Remaining Assets 🔍
The engineering and security teams outlined details of the intrusion and the ongoing digital forensic investigation: [1]
Multiple breach points: After initial findings indicated that a laptop belonging to a DevOps engineer had been targeted, subsequent in-depth investigations uncovered additional complex intrusion points and software protocols used by the attackers to route unauthorized transactions. [1]
Multiple breach points: After initial findings indicated that a laptop belonging to a DevOps engineer had been targeted, subsequent in-depth investigations uncovered additional complex intrusion points and software protocols used by the attackers to route unauthorized transactions. [1]
97
Log in to explore more content
Join global crypto users on Binance Square
⚡️ Get latest and useful information about crypto.
💬 Trusted by the world’s largest crypto exchange.
👍 Discover real insights from verified creators.
Email / Phone number
Trending Topics
1
#BinanceIncidentReport
2,384 views
165 Discussing
2
#BinanceReopensWithdrawalsForMoreAssets
88,802 views
1,483 Discussing
3
#BinanceHourlyDepositsExceedWithdrawals
41,295 views
634 Discussing
4
#USMidtermElections
812,789 views
4,386 Discussing
5
#AnthropicIPOPricedDownasInvestorsEye$1.5T
1,174 views
35 Discussing
6
#USOctoberNFP-AreRateCutsStillPossible
148,502 views
1,168 Discussing
7
#AppleReportsMixedResults
46,430 views
909 Discussing
8
#PalantirSlides3PercentOn$2BRevenue
2,832 views
39 Discussing
9
#FrenchAssemblyRejectsTwoCryptoExitTaxProposals
5,942 views
154 Discussing
10
#Nasdaq100EntersCorrection
10,064 views
160 Discussing