Binance has published a preliminary report on the major security incident of October 29: approximately $6.34 billion in assets were affected, of which about $2.85 billion has been frozen or intercepted. Binance has pledged to cover all losses and says it had reserved more than 100% of the required funds. As of October 31, 98% of affected token assets had been replenished and can be verified on the Proof of Reserves page; a small amount of low-liquidity assets is still being purchased.
The latest information from the FBI indicates that North Korea was responsible for the attack. On-chain losses included 233.46 million XRP, approximately 970,500 SOL, 44.2 million OP, and 18,270 BTC. The attackers first gained unauthorized access to an internal wallet-signing service, then exploited Ethereum’s EIP-7702 authorization mechanism to establish malicious delegations, bypassing the withdrawal suspension and continuing to transfer assets.
This was not a one-off breach, but a multi-stage attack spanning several months: in June, the attackers launched a supply-chain poisoning campaign using a tampered Homebrew package; in September, they socially engineered an engineer through a fake job interview and installed 0-day malware; on October 20, they used an internal AI tool on a compromised computer to escalate their access, ultimately breaching signing operations on October 29.
Binance says it has rebuilt its wallet systems and internal AI tools, replaced devices, disabled credentials, and completed security scans for all staff. It will also introduce third-party security reviews and establish a security research fund. The incident is another reminder that AI tool permissions, employee defenses against social engineering, and supply-chain security are becoming new front lines in exchange security. #币安 #网络安全 #BlockchainSecurity
The latest information from the FBI indicates that North Korea was responsible for the attack. On-chain losses included 233.46 million XRP, approximately 970,500 SOL, 44.2 million OP, and 18,270 BTC. The attackers first gained unauthorized access to an internal wallet-signing service, then exploited Ethereum’s EIP-7702 authorization mechanism to establish malicious delegations, bypassing the withdrawal suspension and continuing to transfer assets.
This was not a one-off breach, but a multi-stage attack spanning several months: in June, the attackers launched a supply-chain poisoning campaign using a tampered Homebrew package; in September, they socially engineered an engineer through a fake job interview and installed 0-day malware; on October 20, they used an internal AI tool on a compromised computer to escalate their access, ultimately breaching signing operations on October 29.
Binance says it has rebuilt its wallet systems and internal AI tools, replaced devices, disabled credentials, and completed security scans for all staff. It will also introduce third-party security reviews and establish a security research fund. The incident is another reminder that AI tool permissions, employee defenses against social engineering, and supply-chain security are becoming new front lines in exchange security. #币安 #网络安全 #BlockchainSecurity