binanceincidentreport

On 29 October 2026, Binance experienced a serious and highly sophisticated security incident. This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry.Our first responsibility is to protect users. Binance will absorb the financial impact of the stolen funds, not our users. We have already set aside more than 100% of the funds required to cover the loss. As of 31 October 2026, 98% of the impacted token assets have been replenished and are verifiable on our Proof of Reserves page. We are in the process of purchasing the outstanding, more illiquid assets.Approximately USD 6.34 billion in digital assets were impacted by the incident. As of this update, approximately USD 2.85 billion in digital assets have been frozen or intercepted, subject to reconciliation and market price volatility.We have taken immediate action to contain the incident and strengthen the systems involved. The entry points identified as having been used in the attack have been closed. Systems touched in the attack path have been rebuilt or replaced. We have also implemented tighter device controls, enhanced wallet-service risk controls and expanded AI-based behavioural anomaly detection.This is our initial report. It covers what we know today and what we have already improved. The investigation remains ongoing and our findings will be subject to further independent review. Some technical details will remain confidential to prevent malicious actors from using them to plan attacks. We are engaging independent security firms for further review. The latest information released by the Federal Bureau of Investigation indicates that the Democratic People’s Republic of Korea is responsible for this incident.We are sharing this initial report because security improves when the industry learns together.What happened on 29 OctoberThe attack unfolded quickly across several networks.The attacker exploited unauthorized access to an internal wallet signing service to initiate transactions outside the normal withdrawal process.Between 20:05 UTC and 20:09 UTC, five Binance hot wallets sent 233.46 million XRP to an attacker-controlled address.Binance hot wallets on Solana and Optimism sent approximately 970,500 SOL and 44.2 million OP to attacker-controlled addresses.Binance then received an internal alert regarding large-volume transfers and immediately began investigating.Binance hot wallet sent 18,270 BTC to an attacker-controlled address. The attacker then used the signing service to exploit Ethereum’s EIP-7702 authorization mechanism. EIP-7702 allows an account to delegate certain execution rights to a smart contract without exposing the private key. In this case, the attacker used that mechanism to give an attacker-controlled smart contract partial execution rights over a Binance hot wallet. Binance immediately initiated multiple containment measures, including suspending withdrawals to restrict further outflows, coordinating with partners to freeze affected tokens, and taking steps to revoke unauthorized permissions. These efforts froze a total of $2.85 billion in assets.However, suspending withdrawals alone could not stop all unauthorized asset movements. The malicious EIP-7702 authorizations existed on-chain and operated independently of Binance’s normal withdrawal infrastructure.The attackers submitted 50 signing transactions to manipulate the account nonce and establish malicious delegation authorizations. Once established, these authorizations enabled the attackers to continue moving assets independently of Binance's normal withdrawal infrastructure. Binance needed additional transactions to revoke these on-chain authorizations.The containment process involved additional technical complexities. Because the hot wallet used Multi-Party Computation (MPC), there was no single private key that could be used to immediately revoke the malicious EIP-7702 authorizations. The team therefore developed and executed a specialized procedure to revoke these authorizations, which required additional time. Furthermore, suspending withdrawals and shutting down hot wallet services did not automatically invalidate existing on-chain authorizations.These challenges extended the time required to fully contain the unauthorized asset movements. We are reviewing the incident response process, signing policy coverage, hot wallet controls and identifying opportunities to further strengthen our ability to respond rapidly to threats in the future.The final unauthorized transfer of 2,961.9 ETH finalised on-chain at 23:56 UTC. The transaction had previously been broadcast and remained pending before subsequently finalising. No further unauthorised transfers were observed after.At 00:10 UTC on 30 October 2026, Binance executed a new authorization from the Binance14 hot wallet to the zero address, clearing the EIP-7702 delegation code.Attack Preparation Our current investigation indicates that this was a sophisticated, multi-stage campaign. It was not a single isolated breach or a simple phishing incident. The attackers combined a range of techniques, including social engineering by fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise, and an advanced transaction-authorisation method.June 2026 — Supply chain attack. Engineer A from Wallet DevOps downloaded a tampered Homebrew installation in order to install a popular AI coding tool after searching for it on a search engine. Our security team detected the anomaly, replaced the device, and rotated all related credentials as a proactive security action. However, Engineer A’s role and his related colleagues on our wallet infrastructure team was exposed to the hacker. Throughout 2026, Binance's security team detected and prevented 57 suspected North Korea-linked cyber threat cases. These attempts reflect the persistent threat posed by state-sponsored actors targeting the cryptocurrency industry. The techniques include fraudulent job interviews, malicious software disguised as popular developer tools, compromised software packages and browser extensions, fake video conferencing applications, and social engineering campaigns designed to steal credentials or deploy remote access malware.September 2026 — social engineering. Software Engineer B was contacted through a legitimate job-hunting platform by an individual posing as a Project Director. Software Engineer B had a profile on the platform that referenced his experience at Binance. The purported Project Director arranged a first-round interview with a HR representative, followed by a second-round interview with an individual claiming to be the CEO of a fictitious company.In the first round, the purported HR representative conducted a live video interview with Software Engineer B. The interviewer shared a social media account with him, including personal photos and videos posted on the platform, in order to build trust. This was more advanced and deceptive than previously seen social engineering approaches. The second interview was conducted in a popular social chat app, near the end of the interview, Engineer B was instructed to download an “assignment” containing a malicious code repository onto his work computer. The repository contained malicious code that executed during the setup process, initiating a series of unauthorized activities.The malware employed sophisticated obfuscation and evasion techniques, including replacing a legitimate development tool component with a malicious version to execute commands and establish communication with an attacker-controlled external server. The 0-day malware was not detected by the endpoint security protection tools at the time. The attacker also took steps to conceal the malicious activity and remove traces of the compromise, making detection and subsequent investigation more challenging.The script executed the below steps by applying obfuscation techniques to evade security detection.CREATE /opt/homebrew/Cellar/pyenv/2.8.0/libexec/pyenv_ MODIFY pyenv_ → 3,414 B DELETE .../libexec/pyenv (3,344 B) ← remove the valid pyenvRENAME pyenv_ → pyenv (3,414 B) ← replace it with a malicious version DELETE /opt/homebrew/bin/pyenv (3,414 B)ln (create a new symlink) + spawn zsh20 October, 2026 — use of an internal AI tool as a springboard. The attacker leveraged the compromised computer of engineer B and used an internal AI tool to gain control over the Wallet DevOps Engineer A and another Wallet Software Engineer C. The attacker soon discovered Wallet DevOps Engineer A had a container deployment permission token on his computer.29 October, 2026 — reach into wallet signing operations. On 29 October between 17:15 and 19:56, the attacker logged onto Software Engineer C’s computer, used the credentials stolen from Wallet DevOps Engineer A, deployed a container, and triggered a malicious script to launch the attack.What we have doneAs of Nov 3, 2026, we have taken the following actions:Rebuilt the affected wallet system in a new environment.Rebuilt the affected internal AI tool and access controls.Replaced affected devices.Decommissioned credentials and tokens related to affected engineers.Completed enhanced security scans across all employee devices.Enhanced AI-based behavioural anomaly detection.Strengthened wallet-service risk controls.Worked with law enforcement, blockchain intelligence firms and industry partners to trace and freeze affected assets.We will continue to strengthen our measures as the investigation progresses. There are a number of security measures we have implemented and are implementing that will remain private to prevent malicious actors from compromising our security.Further actionsWe are taking the following steps immediately.1. Independent cybersecurity reviewWe are engaging independent third-party cybersecurity experts to conduct a comprehensive review of the incident, validate our findings and recommend additional measures. The scope and findings of that review will inform our continuing remediation work.2. Expanded investment in AI security and preventionWe are increasing investment in AI-enabled detection, endpoint protection, developer-environment security and behavioural anomaly monitoring.3. Security research fund and industry initiativesWe are working on establishing a security research fund and targeted initiatives with leading AI companies, industry participants and security firms focused on AI security in blockchain environments.We will continue to proactively share information as and when we have it.

On October 29, 2026, the cryptocurrency industry witnessed one of its most significant security challenges to date. Binance experienced a major security breach involving unauthorized withdrawals from its hot wallet infrastructure, with total affected assets estimated at approximately $6.34 billion.
​If you are an investor or user on the platform, here is a clear breakdown of how the incident unfolded, the immediate actions taken, and what it means for your funds.
​How the Breach Occurred
Following an initial investigation, Binance disclosed that the breach was a sophisticated, multistage campaign. The attackers utilized social engineering tactics—including a fake job interview—targeting a DevOps engineer. By compromising the engineer's device and exploiting an internal AI tool, the malicious actors were able to access a service container and authorize unauthorized withdrawal transactions across multiple blockchain networks.
​Importantly, Binance confirmed that there is no evidence of any wallet private keys being leaked. Blockchain intelligence firms, including TRM Labs and the FBI, have attributed the attack with high confidence to the North Korea-linked hacking group known as TraderTraitor.
​Binance’s Immediate Response and Fund Security
The most critical takeaway for retail and institutional users is that user funds are safe. Binance has committed to covering all financial losses entirely through its Secure Asset Fund for Users (SAFU) and corporate treasury reserves.
​To contain the fallout, Binance immediately:
​Temporarily suspended withdrawals to conduct comprehensive security checks.
​Partnered with blockchain intelligence firms and law enforcement to track and freeze stolen funds, successfully freezing roughly $3 billion on-chain so far.
​Rebuilt affected systems, replaced compromised devices, and revoked the relevant credentials and tokens.
​What Happens Next?
Binance is currently restoring withdrawal services in phased rollouts for various assets. The exchange has also pledged to publish a highly detailed technical post-mortem and an updated Proof of Reserves once the remediation process and independent cybersecurity reviews are complete. Moving forward, the company plans to heavily increase its investments in AI-enabled security infrastructure and industry-wide research initiatives to prevent future exploits.
​While an incident of this scale is a stark reminder of the sophisticated cyber threats facing the digital asset space, Binance’s rapid containment, transparency, and full financial backing demonstrate the resilience required to protect user trust.
​Stay tuned to official Binance announcements for the most accurate and up-to-date information regarding your specific assets.
$BNB
​#binanceincidentreport #Binance #Hack

The crypto world received another uncomfortable reminder on October 29: even the biggest players aren't bulletproof! 😳 Binance has published its initial findings and response following a massive security incident that exposed vulnerabilities in its internal infrastructure.
🔍 According to the investigation, attackers allegedly exploited compromised employee infrastructure to gain access to internal systems and authorize malicious transactions. Even more interesting, reports suggest a fake job interview played a role in compromising a computer before internal AI tools were allegedly exploited. Talk about a job interview from hell! 😂💻
💰 Binance says it has mobilized substantial financial resources to absorb the impact, while working with security experts, blockchain investigators and law enforcement to contain the incident and freeze affected assets.
🛡️ The exchange has also promised stronger security controls, improved threat detection and greater transparency through updated Proof of Reserves reporting.
🤔 But here's the bigger lesson: Blockchain technology may be decentralized, transparent and incredibly sophisticated, but the companies operating within the ecosystem still have very human vulnerabilities.
An exchange can build digital fortresses, deploy armies of cybersecurity experts and invest millions in technology, yet one compromised laptop can potentially open doors that should have remained locked!
🔑 And this is another reminder of why self-custody matters. Not your keys, not your coins! Of course, holding your own keys also means becoming your own security department. No customer support hotline can magically recover a forgotten seed phrase! 🤣
🌍 Ultimately, Binance's response will be judged not just by how much money it can cover, but by how transparently it explains what happened and prevents a repeat.
🚀 Crypto promises financial freedom. Protecting that freedom requires security, accountability and constant vigilance!
#BinanceIncidentReport
$BNB $BTC

#binanceincidentreport
After the reported $6.3 billion security incident, Binance says 95% of affected assets have been replenished.
👀 Withdrawals are reportedly stabilizing.
🔐 The exchange says customer losses are covered.
But one question remains:
Can Binance fully restore investor confidence?
💬 Would you still trust a centralized exchange?
#Binance #CryptoSecurity #CryptoNews #BinanceSquare