Update on the security incident experienced by Binance on October 30, 2026: Initial investigation findings and progress on the measures taken
On October 30, 2026 (UTC+8), Binance experienced a complex security incident involving assets valued at approximately US$6.34 billion, of which nearly US$2.85 billion was frozen or intercepted. Binance is absorbing all losses and has secured financial coverage exceeding 100%. As of October 31, 98% of the affected tokens had been recovered.
Investigations revealed that the attackers (who, according to FBI estimates, are believed to be from the Democratic People’s Republic of Korea) compromised employees’ devices through supply chain attacks, social engineering (fake job interviews), and malware. They then used internal AI tools as a launchpad, ultimately gaining access privileges to internal wallet signing services, and exploited Ethereum’s EIP-7702 delegation mechanism to bypass the infrastructure and withdraw and transfer assets. The affected assets included XRP, SOL, OP, BTC, ETH, and others.
Actions taken: Binance closed the breach points, rebuilt the affected wallet systems and internal AI tools, replaced devices and disabled the relevant credentials, strengthened anomaly detection for AI behavior, and improved wallet risk management. Independent security firms are currently being engaged to conduct reviews, and plans are underway to establish a specialized research fund focused on AI security in the blockchain space.$SOL
