Binance Security Incident - 29 October 2026: What Happened And How We Responded
Binance Blog
Verified Binance Official Account
On 29 October 2026, Binance faced one of the most sophisticated security attacks in its history. This should never have happened, and we sincerely apologize to our users, partners and the entire crypto community for the fear and confusion it created.$NVDAB
Our first priority has always been user protection. Binance will bear the full financial loss - not our users. We have already reserved more than 100% of the funds needed to cover the loss. As of 31 October 2026, 98% of the affected token assets have been restored and can be verified on our Proof of Reserves page. We are now working to buy back the remaining illiquid assets.
Approximately USD 6.34 Billion in digital assets were affected in this incident. As of this update, around USD 2.85 Billion has been successfully frozen or intercepted with the help of our partners, subject to market price changes.$BTC
We acted immediately to stop the attack and secure the systems involved. The entry points used by the attacker have been closed. All systems in the attack path have been rebuilt or replaced. We have also tightened device controls, improved wallet-service risk checks, and expanded AI-based anomaly detection.$AAPLB
This is our initial report. It explains what we know so far and what we have already fixed. The investigation is still ongoing and will be reviewed by independent security experts. Some technical details will stay private to stop attackers from using them again.
According to the latest information released by the FBI, the Democratic People's Republic of Korea (North Korea) is responsible for this incident.
We are sharing this report because security becomes stronger when the whole industry learns together.
What Happened on 29 October
The attack happened very fast across multiple blockchains.
The attacker got unauthorized access to an internal wallet signing service and started transactions outside the normal withdrawal system.
*Between 20:05 UTC and 20:09 UTC:*
Binance hot wallets sent 233.46 Million XRP to an attacker-controlled address.
Binance hot wallets on Solana and Optimism sent around 970,500 SOL and 44.2 Million OP to attacker addresses.
Binance received an internal alert about large unusual transfers and immediately started investigation.
After that, a Binance hot wallet sent 18,270 BTC to an attacker-controlled address.
The attacker then used Ethereum's *EIP-7702 authorization mechanism*. EIP-7702 allows an account to delegate some execution rights to a smart contract without sharing the private key. In this case, the attacker used it to give an attacker-controlled smart contract partial control over a Binance hot wallet.
Binance immediately took containment steps, including suspending withdrawals, working with partners to freeze affected tokens, and revoking unauthorized permissions. These efforts froze a total of $2.85 Billion in assets.
But suspending withdrawals alone could not stop everything. The malicious EIP-7702 authorizations were already on-chain and worked independently of Binance's withdrawal system. The attackers submitted 50 signing transactions to change the account nonce and create malicious delegation authorizations. Once created, these authorizations allowed them to keep moving assets.
The containment was technically complex. Because the hot wallet used Multi-Party Computation (MPC), there was no single private key to instantly revoke the malicious authorizations. Our team had to build and execute a special procedure to revoke them, which took extra time.
The final unauthorized transfer of 2,961.9 ETH was finalized on-chain at 23:56 UTC. No further unauthorized transfers were seen after that.
At 00:10 UTC on 30 October 2026, Binance executed a new authorization from the Binance14 hot wallet to the zero address, clearing the EIP-7702 delegation code.
Attack Preparation
Our investigation shows this was not a simple phishing attack. It was a multi-stage, months-long campaign combining social engineering, fake recruitment interviews, malicious software, compromised internal AI tooling, and advanced transaction manipulation.
*June 2026 - Supply Chain Attack:*
Engineer A from Wallet DevOps downloaded a tampered Homebrew installer to install a popular AI coding tool after searching for it online. Our security team detected the anomaly, replaced the device, and rotated all credentials. However, Engineer A's role and his colleagues on the wallet team were exposed to the attacker.
Throughout 2026, Binance's security team detected and blocked 57 suspected North Korea-linked cyber threat cases. These included fake job interviews, malicious software disguised as developer tools, compromised packages, fake video conferencing apps, and social engineering to steal credentials.
*September 2026 - Social Engineering:*
Software Engineer B was contacted on a legitimate job-hunting platform by a person posing as a Project Director. Engineer B had mentioned his Binance experience on his profile. The fake Director arranged a first-round interview with an HR representative, then a second-round with a fake CEO.
In the first round, the fake HR did a live video interview and shared a social media account with personal photos and videos to build trust. This was far more advanced than normal phishing.
In the second interview, held on a popular social chat app, Engineer B was asked to download an "assignment" containing a malicious code repository onto his work computer. The repository ran malicious code during setup.
The malware used advanced obfuscation, replacing a legitimate development tool component with a malicious version to run commands and connect to an attacker-controlled server. The 0-day malware was not detected by endpoint security tools at that time. The attacker also tried to hide traces of the compromise.
*20 October 2026 - Internal AI Tool Compromised:*
The attacker used Engineer B's compromised computer and an internal AI tool to gain control over Wallet DevOps Engineer A and another Wallet Engineer C. The attacker found that Engineer A had a container deployment permission token on his computer.
*29 October 2026 - Wallet Signing Attack:*
Between 17:15 and 19:56, the attacker logged onto Engineer C's computer, used Engineer A's stolen credentials, deployed a container, and triggered a malicious script to launch the attack.
What We Have Done
As of 3 Nov 2026, we have taken the following actions:
- Rebuilt the affected wallet system in a new secure environment.
- Rebuilt the affected internal AI tool and its access controls.
- Replaced all affected devices.
- Decommissioned credentials and tokens related to affected engineers.
- Completed enhanced security scans across all employee devices.
- Enhanced AI-based behavioural anomaly detection.
- Strengthened wallet-service risk controls.
- Worked with law enforcement, blockchain intelligence firms and industry partners to trace and freeze affected assets.
We will continue to strengthen our measures as the investigation continues. Some security measures will remain private to protect our users.
Next Steps
1. Independent Cybersecurity Review
We are engaging independent third-party experts to conduct a full review of the incident, validate our findings, and recommend more measures.
2. Expanded Investment in AI Security
We are increasing investment in AI-enabled detection, endpoint protection, developer-environment security and behavioural monitoring.
3. Security Research Fund
We are working to establish a security research fund with leading AI companies, industry participants and security firms focused on AI security in blockchain environments.
