By Joey Awwad | Binance User Since 2019 | Binance Angel

There are moments when you stop scrolling, read something twice, and genuinely need a few seconds to process what you have just seen. October 29, 2026, was one of those moments. Binance, the platform I have been using since 2019, the platform where I started my crypto journey with just 20$ gifted to me by my cousin, had experienced a massive security incident. The numbers were almost impossible to comprehend. Approximately 6.34 billion$ in digital assets had been impacted. Six billion. Three hundred and forty million. Dollars. Let that sink in.

As a Binance user, an investor, a trader, and a Binance Angel, this was not just another headline about another exchange experiencing a security problem. It hit differently. I have spent years learning through Binance, trading on Binance, participating in its community, attending events, sharing educational content, and encouraging people around me to understand the opportunities and risks of this industry. I have also spent years telling people why I trust this platform. So naturally, I paid attention to every update. But here is something I want to make clear from the beginning: I was not going to pretend that the incident was insignificant. It was serious, it was concerning, and it deserved accountability. However, being concerned about a security incident and immediately losing confidence in a platform are two different things.

I did not panic. I did not suddenly decide that eight years of experience meant nothing. And I certainly did not see a reason to abandon a platform before understanding what had happened and, more importantly, how it would respond. What followed was a security incident, a complicated investigation, a race against time, billions in asset replenishment, infrastructure rebuilding, and a recovery operation that deserves to be documented properly.

This is the story of what happened, how it happened, what Binance did next, and why, as a user and Binance Angel, this experience reinforced something important for me about accountability.

It Did Not Start on October 29. One of the most interesting things about this incident is that the attack did not begin on the day the funds moved. According to Binance's initial investigation, the attackers had been preparing their way into the company's infrastructure for months. The first relevant event dates back to June 2026. An engineer from Binance's Wallet DevOps team, identified in the investigation as Engineer A, downloaded a tampered Homebrew installation while searching for a popular AI coding tool. The compromised installation was designed to introduce malicious activity into the development environment. Binance's security team detected an anomaly, replaced the affected device, and rotated the related credentials as a precaution. However, the attackers had already gained valuable information about the engineer's role and the colleagues connected to the wallet infrastructure team. Then came September. A second employee, Software Engineer B, was approached through a legitimate job-hunting platform. Someone posing as a Project Director contacted him about a potential opportunity at a fictitious company. The approach was carefully constructed. First came an interview with someone claiming to be an HR representative. It was conducted through a live video call. To build credibility, the interviewer shared a social media account containing personal photographs and videos, creating the appearance of a genuine person with an established online presence. Then came the second interview. This time, the conversation took place through a popular social messaging application. Near the end of the interview, Engineer B was asked to download a coding assignment. That assignment was the trap.

The repository contained malicious code that executed during the setup process on his work computer. The malware used sophisticated obfuscation techniques, replaced a legitimate development-tool component with a malicious version, and established communication with an external server controlled by the attackers. The malware was a zero-day threat that was not detected by the endpoint security tools in place at the time. In other words, this was not someone simply guessing a password or exploiting a straightforward weakness in a withdrawal system. The attackers used a combination of social engineering, malicious software, compromised devices, and internal access to work their way towards a much more sensitive target. And that target was the wallet infrastructure.

October 20: The Attackers Find Their Way Deeper. The next important date was October 20, 2026. According to Binance's investigation, the attackers leveraged Engineer B's compromised computer and an internal AI tool to gain control over the accounts and access of two other employees: Wallet DevOps Engineer A and Software Engineer C. During this process, the attackers discovered that Engineer A had a container deployment permission token stored on his computer. This was a critical discovery. A deployment token can provide access to systems responsible for running software and services. In the wrong hands, that access can become a bridge into infrastructure that should never be controlled by an unauthorized person. The attackers now had a path towards the wallet signing operations.

October 29: The Day Everything Unfolded. The final stage began on October 29. Between 17:15 and 19:56 UTC, the attackers accessed Software Engineer C's computer, used credentials stolen from Engineer A, deployed a container, and triggered a malicious script. The compromised environment gave them unauthorized access to an internal wallet transaction signing service. This is where the technical part becomes particularly important. A wallet signing service is responsible for authorizing blockchain transactions. It is a critical security component because transactions need to be signed before they can be broadcast to a blockchain. The attackers abused this access to initiate transactions outside Binance's normal withdrawal process. At approximately 20:05 UTC, the suspicious asset movements began. Between 20:05 and 20:09 UTC, five Binance hot wallets transferred approximately 233.46 million XRP to an address controlled by the attackers. The attackers also moved approximately: 970,500 SOL through Binance hot wallets on Solana. 44.2 million OP through Binance hot wallets on Optimism. 18,270 BTC from a Binance hot wallet. The incident involved multiple networks and different assets, and the total impact was estimated at approximately $6.34 billion. Binance received an internal alert concerning large-volume transfers and immediately began investigating. But the attackers had another trick.

The Technical Exploit: How EIP-7702 Was Abused. One of the most important technical elements of this incident involved Ethereum's EIP-7702 authorization mechanism. For anyone unfamiliar with it, EIP-7702 is an Ethereum improvement that allows an externally owned account to temporarily delegate certain execution capabilities to smart contract code. It does not require exposing the account's private key. In this incident, the attackers abused the signing service to create malicious EIP-7702 delegations, giving a smart contract they controlled partial execution rights over a Binance hot wallet. They submitted 50 signing transactions to manipulate the account nonce and establish these malicious authorizations. This created a particularly difficult containment problem. Why? Because stopping the normal withdrawal system was not enough. The malicious authorizations already existed on-chain and could operate independently of Binance's usual withdrawal infrastructure. Binance could suspend withdrawals, shut down hot wallet services, and restrict normal transaction processing, but those actions would not automatically invalidate authorizations that had already been established on the blockchain. There was another complication: the affected hot wallet used Multi-Party Computation, or MPC. MPC distributes the signing process across multiple parties rather than relying on one private key. This is an important security design, but it also meant Binance could not simply use one private key to immediately revoke the malicious authorizations. The engineering team had to develop and execute a specialized procedure to remove those permissions through additional on-chain transactions. This explains why the incident was not contained simply by pressing a button or temporarily suspending withdrawals. It required a coordinated technical response.

The Final Unauthorized Transfer: 23:56 UTC. According to Binance's report, the final unauthorized transfer, amounting to 2,961.9 ETH, was finalized on-chain at 23:56 UTC on October 29. The transaction had been broadcast earlier and remained pending before confirmation. Binance reported no further unauthorized transfers after that transaction.

At 00:10 UTC on October 30, Binance executed a new authorization from the Binance14 hot wallet to the zero address, clearing the malicious EIP-7702 delegation code. The immediate unauthorized movement of funds had been stopped. However, stopping the attack was only the beginning. The next challenge was arguably just as important: protecting users, restoring the affected assets, reopening withdrawals, and demonstrating that the company could absorb the financial impact.

The First Decision That Mattered: Users Would Not Pay for This. This is where I believe the response deserves particular attention. Binance publicly committed to absorbing the financial impact of the stolen funds rather than passing those losses to its users.

Let me repeat that.

The company did not announce that customers would have to accept a haircut on their balances. It did not announce that users would be responsible for covering the stolen assets. It committed to covering the incident through its own resources.

On October 30, Binance explained that it had already set aside more than 6.34 billion$ to cover the losses. Approximately 5 billion $ was held in the exact affected token assets, with the company acquiring the remaining assets through market purchases and over-the-counter channels.

The coverage involved two major sources:

1. SAFU: Secure Asset Fund for Users. SAFU is Binance's emergency protection reserve established to help protect users in extreme circumstances. It is not an ordinary trading account or a personal wallet belonging to an executive. It is a dedicated user protection fund.

2. Binance's corporate resources. Binance also committed its own company resources and treasury funds to cover the incident.

This distinction matters because the responsibility was taken at the company level. There has been no official announcement that the recovery was funded through Richard Teng's personal account, CZ's personal account, or another executive's private wealth. The reported funding sources were SAFU and Binance's corporate resources.

As a user, this was one of the most important parts of the entire story for me. The attack was serious, but the company was taking responsibility for its financial consequences instead of transferring them to the people who trusted it with their assets.

The Recovery Operation: Billions, Blockchain Partners, and a Race Against Time. While the financial coverage was being arranged, Binance was also working on recovering and replenishing the affected assets. The first priority was to trace the stolen funds and prevent as much as possible from moving further. Binance coordinated with law enforcement agencies, blockchain intelligence firms, token issuers, and industry partners. By the time of its November 3 investigation report, Binance stated that approximately 2.85 billion$ in assets had been frozen or intercepted. This figure was subject to reconciliation and market price volatility. Freezing funds and replenishing funds are two different processes. Frozen assets are funds that have been prevented from moving or accessing their intended destination through coordination with relevant networks and partners. Replenishment, on the other hand, means Binance acquiring replacement assets so that the affected token balances can be restored. Binance worked through market purchases and OTC channels to acquire the required assets, including tokens that were less liquid and therefore more difficult to source in large quantities. And this is where the recovery numbers started moving quickly.

October 30: More Than 6.34 Billion$ Set Aside. Binance confirmed that it had allocated more than 6.34 billion $ in company resources to cover the incident, with approximately 5 billion $ already held in the affected token assets. The company also worked with industry partners to freeze assets and contain the incident.

October 31: Approximately 90% Replenished. Binance's Recovery Update #3 reported that approximately 90% of the stolen assets had been replenished. The company also provided a Proof of Reserves snapshot as part of its transparency efforts.

November 1–2: Withdrawals Begin Reopening. Once the affected infrastructure had been secured and the necessary checks completed, Binance began reopening withdrawals in phases. This was not a decision to simply switch everything back on at once. Different assets and networks needed individual security and readiness checks. On November 2, Binance also confirmed that its October 31 Proof of Reserves snapshot had become fully verifiable through its zero-knowledge proof. This gave users another way to independently verify the backing of their covered balances.

November 3: The Investigation Becomes Public. Binance published its detailed initial findings, explaining how the attackers had entered the environment, compromised employee devices, exploited internal access, and abused EIP-7702. It also disclosed the security improvements already implemented. These included: Rebuilding the affected wallet system in a new environment, Rebuilding the affected internal AI tool and its access controls, Replacing affected devices, Decommissioning credentials and tokens associated with the affected engineers, Conducting enhanced security scans across employee devices, Strengthening wallet-service risk controls, Expanding AI-based behavioral anomaly detection.

Binance also announced that it was engaging independent cybersecurity experts to review the incident and validate its findings. The company said the FBI's latest information attributed the attack to the Democratic People's Republic of Korea (North Korea).

November 4: 98% Replenished. The latest recovery milestone available at the time of writing was published on November 4. Binance reported that approximately 98% of the affected assets had been replenished. The remaining 2% involved less-liquid tokens, and Binance said it was continuing to purchase them through market and OTC channels. The company also published a new Proof of Reserves snapshot dated November 4, expanding coverage from 10 tokens to 44 tokens. The complete zero-knowledge proof was expected to take approximately 50–60 hours to generate. This is an important detail: Binance had already set aside more than 100% of the required financial coverage, but the actual replenishment of the affected token assets was still at approximately 98%. I would rather explain that accurately than claim that every last token had already been restored.

November 5: More Withdrawals Reopen. The recovery continued. In Recovery Update #8, published on November 5, Binance announced that withdrawals for additional assets would begin reopening from 04:00 UTC. The reopening was being rolled out progressively, with each asset and network undergoing security and readiness checks.

And that is where things stand as I write this story. The attack was contained, the company had financially covered more than the estimated losses, the affected token assets were approximately 98% replenished, and withdrawal services were continuing to return in phases.

Did Binance Really Cover the Losses? Where Did the Money Come From? I think this deserves its own section because it is probably one of the first questions people will ask. Where does a company find 6.34 billion $? The answer is not that a CEO opened a personal bank account and transferred billions of dollars. Binance stated that the financial impact would be covered through SAFU and other company resources. SAFU exists specifically as an emergency protection mechanism for users, while corporate treasury resources provide additional financial capacity. Binance said it had already reserved more than 100% of the required amount. In practical terms, this means the company committed the necessary financial resources to ensure that the affected user balances could be covered without asking customers to absorb the loss. Co-CEO Richard Teng also publicly addressed the company's financial position at Hong Kong FinTech Week on November 3. He described Binance as being in very strong financial health and said the company was capable of covering the incident. He also confirmed that SAFU and other company funds were being used to cover the losses. That is the distinction I want readers to understand: this was a corporate financial responsibility, not a personal donation from an executive.

The Part That Matters to Me: I Never Felt the Need to Run Away. Now, let me bring this back to my own experience. I joined Binance in 2019. My journey started with 20$. Nothing extraordinary. No massive portfolio, no institutional trading account, no complicated investment strategy. Just a birthday gift from my cousin that introduced me to a completely new financial world. Over the years, I learned, traded, made mistakes, explored different products, and watched the industry evolve. Eventually, my relationship with Binance became more than just using an exchange. I became a Binance Angel. I started participating in community activities, educational discussions, AMAs, content creation, and initiatives across the MENA region. I attended Binance Blockchain Week in Dubai in 2025, joined the Angels community, and had the opportunity to contribute to the ecosystem in different ways. That makes this incident personal in a different sense. When a company you have supported for years experiences a crisis of this magnitude, you naturally pay attention. You want answers. You want transparency. You want to know whether the company can stand behind what it has promised. And I did. I followed the announcements, read the technical explanations, monitored the recovery updates, and looked at what the company was actually doing. I was not interested in blind loyalty. I wanted evidence. And what I saw was a company that acknowledged the incident, investigated the entry points, explained the technical mechanism, allocated its own resources, worked with industry partners, replenished affected assets, and gradually restored services. Could the attack have been prevented? That is exactly the question Binance needs to keep investigating. Could the response be improved? Absolutely. Binance itself has acknowledged that its incident response process and wallet controls need further strengthening. But a security incident should be judged not only by how much damage it causes. It should also be judged by how the organization responds, how transparent it is, how it protects customers, and whether it takes responsibility for the consequences. For me, the response mattered. I did not suddenly forget why I started using Binance in 2019. I did not stop believing in the platform because one of the most sophisticated attacks in its history succeeded. I believe trust is built over time, but it is also tested during difficult moments. And this was one serious test.

From Recovery to Appreciation: Binance's Community Campaign. Something else happened while Binance was working through the recovery. On November 2, Binance launched its Community Appreciation Campaign, running until November 21, 2026. I found this particularly interesting because the campaign was not simply a generic trading promotion. It was presented as a way to thank the community for its continued trust and support. The campaign includes two main activities:

1. A 100 USDC Spot Trading Fee Rebate Voucher: Eligible identity-verified users can receive a 100 USDC Spot trading fee rebate voucher through the Rewards Hub. There is an important distinction here: this is a trading fee rebate voucher, not an unrestricted 100 USDC cash giveaway. The rebate is distributed according to the campaign's rules. The voucher provides a daily rebate of 30% of eligible remaining Spot trading fees after referral commissions are deducted, with rebates credited in USDC to the Spot Account. Users need to claim the voucher through Profile > Rewards Hub, and the applicable claiming and expiry periods matter.

The campaign also includes a 20,000,000 USDC reward pool. Users who trade eligible Spot, Margin, Convert, USDⓈ-M Futures, COIN-M Futures, bStocks, and Stock trading pairs and reach at least 10,000$ equivalent in cumulative effective trading volume during the campaign period can qualify for a share of the pool. The individual reward is calculated according to each eligible user's share of the total effective trading volume, with a maximum reward of 4,000 USDC in token vouchers per eligible user under this activity.

2. Up to 10% APR Through Eligible Earn Products: The second activity offers eligible users the opportunity to earn up to 10% APR through selected products. These include: USDC Simple Earn Flexible, USDT Simple Earn Flexible, RWUSD, BFUSD. The exact APR depends on the product, user eligibility, holding amount, VIP level where applicable, and the relevant bonus tier. For example, eligible non-VIP users holding less than 50,000 USD equivalent in USDC can receive a 7% bonus APR on the qualifying tier, on top of the real-time base APR. For USDT Flexible, the campaign offers an 8% bonus APR on the eligible tier, in addition to the real-time base APR. RWUSD and BFUSD also have their own bonus structures. It is important to understand that up to 10% APR does not mean every user receives a guaranteed fixed 10% return on every dollar held. Rates are product-specific, tiered, and subject to change.

The campaign runs from November 2 at 11:30 UTC until November 21 at 23:59 UTC, subject to eligibility and regional availability.

For me, this is another part of the story worth mentioning. Binance was continuing to restore services and strengthen its security while also recognizing the community that remained with it throughout the difficult period. Of course, a promotional campaign is not a replacement for security, transparency, or accountability. Those must stand on their own. But it is still a meaningful community initiative when viewed in the context of everything that happened.

What This Incident Taught Me About Trust. If there is one thing I want people to take away from this experience, it is that trust should never mean ignoring facts. I am a Binance Angel, but that does not mean I should avoid asking questions. I am a long-time user, but that does not mean I should pretend a security incident is nothing. And I am someone who believes in the platform, but I still expect transparency, accountability, and continuous improvement. The incident exposed weaknesses that needed to be addressed. It also demonstrated why security is never a finished project. Technology evolves, attackers become more sophisticated, and even established organizations must continuously challenge their own systems. For Binance, the work does not end with replenishing the assets. The company must continue improving its internal controls, independent security reviews, wallet infrastructure, employee device security, and incident response procedures. For users, the lesson is equally important: use strong account security, enable available protections, remain alert to social engineering, and never download suspicious files or share sensitive credentials. And for the industry, this is another reminder that security is not just about protecting private keys. It is about people, devices, software supply chains, internal permissions, operational procedures, and the ability to respond when something goes wrong.

Eight Years Later, I Am Still Here. When I look back at my journey since 2019, I remember starting with 20$, learning what crypto was, making my first trades, discovering new products, and eventually becoming part of a global community. I never imagined that one day I would be writing about a 6.34 billion$ security incident involving the platform that introduced me to this industry. But here we are. And if there is one thing I can say after following this entire situation, it is that I value the difference between a company that simply promises to protect its users and a company that takes financial responsibility when something goes seriously wrong. Binance has a lot more work to do. The remaining assets still need to be replenished, withdrawal services need to continue returning safely, and the independent security reviews must deliver meaningful improvements. But I have not lost my confidence in the platform. I started this journey in 2019 with 20$. I am still here in 2026, not because I believe any company is immune to attacks, but because I believe that accountability is demonstrated through actions, not slogans. The 6.34 billion $ incident was a painful chapter in Binance's story. It should never be minimized, and the lessons should never be forgotten. But it also became a test of financial responsibility, operational resilience, and the relationship between a platform and its users. And personally, I am not walking away because of a headline. I have been here since 2019. I have seen the ecosystem grow, I have been part of its community, and I have watched Binance face one of its biggest challenges yet. My trust is still here. But more importantly, I will keep expecting the transparency and accountability that trust deserves. Because staying SAFU is not about believing nothing can ever go wrong. It is about knowing what happens when something does.

I have always believed in Binance, but this experience has made that belief even stronger. I believe in my team, in this incredible community, and in every user who stands with us. You are my second family. We stand together, we support one another, and we have each other's backs. My sincere thank you to @CZ , the entire Binance security team, the developers, engineers, and everyone who worked tirelessly behind the scenes to protect our funds. I am forever grateful, first as a user since 2019 and now as a Binance Angel.@Binance MENA @Binance Angels Perhaps this is more personal than people might realize. My country, Lebanon, has experienced a financial collapse that wiped out people's life savings and left many of us with little or nothing to rely on. I know what it feels like to see years of hard work disappear and to question whether your money is truly safe. Binance gave me a different experience, and when another major challenge came, it once again stood behind its users. Different circumstances, different protections, but one thing remained the same: I did not have to face the loss alone.

Binance, thank you for standing by us. Thank you for protecting what we worked hard for, and thank you for giving me another reason to believe. Forever grateful.🙏🏼