On October 29, 2026, Binance suffered a serious and highly sophisticated security incident. This should not have happened, and we apologize for the concern, disruption, and uncertainty it caused our users, partners, and the industry as a whole.
Our primary responsibility is to protect users. Binance will bear the financial impact of the stolen funds, not our users. We have already reserved more than 100% of the funds needed to cover the losses. As of October 31, 2026, 98% of the affected token assets had been restored, as can be verified on our Proof of Reserves page. We are currently in the process of acquiring the remaining assets, which are less liquid.
The incident affected approximately USD 6.34 billion in digital assets. As of this update, approximately USD 2.85 billion in digital assets have been frozen or intercepted, subject to reconciliation and market price volatility.
We took immediate steps to contain the incident and strengthen the systems involved. The identified access points used in the attack were closed. Systems involved in the attack path were rebuilt or replaced. We also implemented stricter device controls, strengthened risk controls for wallet services, and expanded AI-based behavioral anomaly detection.
This is our initial report. It presents what we know so far and the improvements we have already implemented. The investigation is ongoing, and our findings will be subject to further independent review. Some technical details will remain confidential to prevent malicious actors from using them to plan attacks. We are working with independent security firms to conduct an additional review.
The latest information published by the United States Federal Bureau of Investigation (FBI) indicates that the Democratic People’s Republic of Korea is responsible for this incident.
We are sharing this initial report because security improves when the industry learns and shares knowledge together.
What happened on October 29
The attack unfolded rapidly across several networks.
The attacker exploited unauthorized access to an internal wallet transaction signing service to initiate operations outside the usual withdrawal process.
Between 20:05 and 20:09 UTC, five Binance hot wallets sent 233.46 million XRP to an address controlled by the attacker.
Binance hot wallets on Solana and Optimism sent approximately 970,500 SOL and 44.2 million OP to addresses controlled by the attacker.
Binance later received an internal alert related to large-volume transfers and immediately began an investigation.
A Binance hot wallet sent 18,270 BTC to an address controlled by the attacker.
The attacker then used the signing service to exploit Ethereum’s EIP-7702 authorization mechanism. EIP-7702 allows an account to delegate certain execution rights to a smart contract without exposing its private key. In this case, the attacker used this mechanism to grant a smart contract under their control partial execution rights over a Binance hot wallet.
Binance immediately initiated several containment measures, including suspending withdrawals to limit further outflows, coordinating with partners to freeze the affected tokens, and implementing measures to revoke unauthorized permissions. These efforts enabled a total of USD 2.85 billion in assets to be frozen.
However, suspending withdrawals alone could not stop all unauthorized asset movements. The malicious EIP-7702 authorizations were already on-chain and operated independently of Binance’s usual withdrawal infrastructure.
The attackers sent 50 signing transactions to manipulate the account nonce and establish malicious delegation authorizations. Once established, these authorizations allowed the attackers to continue transferring assets independently of Binance’s usual withdrawal infrastructure. Binance therefore needed to execute additional transactions to revoke these authorizations on-chain.
The containment process involved additional technical complexities. Because the hot wallet used multiparty computation (MPC), there was no single private key that could be used to immediately revoke the malicious EIP-7702 authorizations. The team therefore developed and executed a specialized procedure to revoke these authorizations, which required additional time. In addition, suspending withdrawals and shutting down hot wallet services did not automatically invalidate existing on-chain authorizations.
These challenges extended the time needed to fully contain unauthorized asset movements. We are reviewing the incident response process, signing policy coverage, and hot wallet controls, as well as identifying opportunities to strengthen our ability to respond quickly to future threats.
The final unauthorized transfer, totaling 2,961.9 ETH, was confirmed on-chain at 23:56 UTC. The transaction had been broadcast earlier and remained pending before confirmation. No further unauthorized transfers were observed after this transaction.
At 00:10 UTC on October 30, 2026, Binance executed a new authorization from the Binance14 hot wallet to the zero address, removing the EIP-7702 delegation code.
Attack preparation
Our current investigation indicates that this was a sophisticated, multi-stage campaign. It was not an isolated intrusion or a simple phishing incident. The attackers combined various techniques, including social engineering through fake job interviews, malicious software downloads, compromised internal AI tools, device compromise, and an advanced transaction authorization method.
June 2026: software supply chain attack
Engineer A, from the Wallets DevOps team, downloaded a modified Homebrew installer to install a popular AI-based programming tool after searching for it using a search engine.
Our security team detected the anomaly, replaced the device, and renewed all related credentials as a security precaution. However, Engineer A’s workstation and those of colleagues associated with the wallet infrastructure team were exposed to the attacker.
During 2026, Binance’s security team detected and prevented 57 potential cyberthreats linked to North Korea. These attempts reflect the persistent threat state-sponsored actors pose to the cryptocurrency industry.
The techniques used include fraudulent job interviews, malicious software disguised as popular developer tools, compromised software packages and browser extensions, fake video conferencing applications, and social engineering campaigns designed to steal credentials or install remote access malware.
September 2026: social engineering
Software engineer B was contacted through a legitimate job-search platform by someone posing as a project director. Engineer B had a profile on the platform that mentioned their experience at Binance.
The purported project director arranged an initial interview with a human resources representative, followed by a second interview with someone who claimed to be the CEO of a fictitious company.
During the first interview, the purported human resources representative held a live video call with software engineer B. To build trust, the interviewer shared a social media account with them that included personal photos and videos posted on the platform. This method was more advanced and deceptive than previously observed social engineering techniques.
The second interview took place through a popular social messaging application. Toward the end of the interview, Engineer B was instructed to download a “technical test” containing a malicious code repository to their work computer. The repository contained malicious code that ran during setup and initiated a series of unauthorized activities.
The malware used sophisticated obfuscation and evasion techniques, including replacing a legitimate component of a development tool with a malicious version to execute commands and communicate with an external server controlled by the attacker.
At the time, device security protection tools did not detect the zero-day malware. The attacker also took steps to conceal the malicious activity and erase traces of the intrusion, making both detection and subsequent investigation more difficult.
The script performed the following steps using obfuscation techniques to evade security detection mechanisms:
text
CREATE /opt/homebrew/Cellar/pyenv/2.8.0/libexec/pyenv_
MODIFY pyenv_ → 3,414 B
DELETE .../libexec/pyenv (3,344 B)
← delete the legitimate pyenv file
RENAME pyenv_ → pyenv (3,414 B)
← replace it with a malicious version
DELETE /opt/homebrew/bin/pyenv (3,414 B)
ln (create a new symbolic link) + spawn zsh
October 20, 2026: use of an internal AI tool as an entry point
The attacker leveraged Engineer B’s compromised computer and used an internal AI tool to gain control over Engineer A, from Wallets DevOps, and another Wallets software engineer, identified as Engineer C.
Shortly afterward, the attacker discovered that Engineer A had a token on their computer with permissions to deploy containers.
October 29, 2026: access to wallet signing operations
On October 29, between 17:15 and 19:56 UTC, the attacker logged in to software engineer C’s computer, used the credentials stolen from Engineer A, from Wallets DevOps, deployed a container, and ran a malicious script to launch the attack.
Actions we have taken
As of November 3, 2026, we have taken the following actions:
We rebuilt the affected wallet system in a new environment.
We rebuilt the affected internal AI tool and strengthened its access controls.
We replaced the affected devices.
We deactivated credentials and tokens associated with the affected engineers.
We completed enhanced security analyses of all employees’ devices.
We improved AI-based behavioral anomaly detection.
We strengthened risk controls for wallet services.
We worked with law enforcement, blockchain intelligence firms, and industry partners to trace and freeze the affected assets.
We will continue strengthening our measures as the investigation progresses. We have implemented and are implementing various security measures that will remain confidential to prevent malicious actors from compromising our systems.
Next steps
We are immediately taking the following steps:
1. Independent cybersecurity review
We are engaging independent cybersecurity experts to conduct a comprehensive review of the incident, validate our findings, and recommend additional measures.
The scope and results of this review will inform our ongoing remediation and improvement efforts.
2. Increased investment in AI-based security and prevention
We are increasing our investment in AI-based detection, device protection, development environment security, and behavioral anomaly monitoring.
3. Security research fund and industry initiatives
We are working to establish a security research fund and develop targeted initiatives with leading AI companies, industry participants, and specialized security firms, with a particular focus on AI security in blockchain environments.
We will continue proactively sharing information as it becomes available.