Compiled by: Big Pliers
On November 3, Binance released a preliminary investigation report on the security incident of October 29, disclosing the complete process of the attack and the infiltration path of the attackers behind it. The report shows that the attackers gradually took control of multiple employees' devices through fake recruitment interviews, malware, and compromised internal AI tools, ultimately obtaining wallet signing permissions, and used the EIP-7702 authorization mechanism to bypass the normal withdrawal process and transfer assets.
The incident involved total assets of approximately 6.34 billion US dollars. As of the release of the report, approximately 2.85 billion US dollars in assets had been frozen or intercepted, and 98% of the affected token assets had been replenished. Binance stated that the relevant losses will be borne by the platform, and it has begun rebuilding the affected systems, strengthening security protections, and hiring an independent third party to conduct further review. The report also noted that the latest information from the Federal Bureau of Investigation shows that North Korea is responsible for this incident.
The following is the full text:
On October 29, 2026, Binance suffered a serious and highly complex security incident. This incident should not have happened, and we deeply apologize for the concern, business disruption, and uncertainty it has caused to users, partners, and the entire industry.
Protecting users is always our primary responsibility. The financial losses caused by the stolen funds in this incident will be borne by Binance and will not be passed on to users. We have reserved more than 100% of the loss amount to cover the losses. As of October 31, 2026, 98% of the affected token assets had been replenished, and users can verify this through the Proof of Reserves page. For the portion of less liquid assets that has not yet been replenished, we are in the process of procurement.
The total amount of digital assets involved in this incident was approximately 6.34 billion US dollars. As of the release of this report, approximately 2.85 billion US dollars in digital assets had been frozen or intercepted; the specific amount still needs further verification and may be affected by market price fluctuations.
We immediately took action to contain the impact of the incident and strengthen the security of the affected systems. All confirmed intrusion entry points exploited by the attackers have been closed, and the systems involved in the attack path have also been rebuilt or replaced. In addition, we have further tightened device control measures, strengthened risk controls for wallet services, and expanded AI-based anomalous behavior detection capabilities.
This report is a preliminary investigation report covering the situation we currently understand and the security improvements that have been completed. The investigation is still ongoing, and the relevant findings will also be subject to further independent review. To prevent malicious attackers from using the relevant information to plan attacks, some technical details will remain confidential. We are hiring an independent security company to conduct further review.
The latest information released by the Federal Bureau of Investigation (FBI) shows that the Democratic People's Republic of Korea (DPRK) is responsible for this incident.
We chose to publish this preliminary report because only when the entire industry learns the lessons together can security levels continue to improve.
What Happened on October 29
The attack unfolded rapidly across multiple networks.
The attackers used unauthorized access to the internal wallet signing service to initiate transactions outside the normal withdrawal process.
Between 20:05 and 20:09 UTC, five of Binance's hot wallets transferred 233.46 million XRP to addresses controlled by the attackers.
Subsequently, Binance's hot wallets deployed on the Solana and Optimism networks transferred approximately 970,500 SOL and 44.2 million OP, respectively, to addresses controlled by the attackers.
After that, Binance received an internal alert regarding a large asset transfer and immediately launched an investigation.
One of Binance's hot wallets then transferred 18,270 BTC to an address controlled by the attackers.
Afterward, the attackers used the signing service to further abuse the Ethereum EIP-7702 authorization mechanism.
EIP-7702 allows an account to delegate partial execution authority to a smart contract without exposing the private key. In this incident, the attackers used this mechanism to give a smart contract controlled by them partial execution authority over one of Binance's hot wallets.
Binance immediately launched multiple emergency measures, including suspending withdrawals to limit further outflows of funds, coordinating with partners to freeze affected tokens, and taking measures to revoke unauthorized permissions. Through these actions, a total of 2.85 billion US dollars in assets were frozen.
However, suspending withdrawals alone was not enough to stop all unauthorized asset transfers. The malicious EIP-7702 authorization already existed on-chain and operated independently of Binance's normal withdrawal infrastructure.
The attackers submitted a total of 50 signed transactions, establishing malicious delegation authorizations by manipulating the account nonce (transaction sequence number). Once these authorizations were established, the attackers were able to bypass Binance's normal withdrawal infrastructure and continue transferring assets. Binance had to initiate additional transactions to revoke these on-chain authorizations.
The entire asset control process also faced other technical complexities. Because the hot wallets involved used multi-party computation (MPC) technology, there was no single private key that could be directly used to immediately revoke the malicious EIP-7702 authorization. To this end, the team needed to specially develop and execute a special revocation process, which also required additional time.
In addition, suspending withdrawals and shutting down hot wallet services does not automatically invalidate existing on-chain authorizations.
These challenges extended the time required to fully control unauthorized asset transfers. We are reviewing the emergency response process, signing policy coverage, and hot wallet control measures for this incident, and looking for opportunities to further improve the speed of future threat response.
The last unauthorized transfer was 2,961.9 ETH, which was finally confirmed on-chain at 23:56 UTC. This transaction had previously been broadcast and was in a pending state before it was finally confirmed. No other unauthorized transfers have been observed since then.
At 00:10 UTC on October 30, 2026, Binance executed a new authorization transaction to the zero address through the Binance14 hot wallet, clearing the EIP-7702 delegation code.
Attack Preparation Process
The current investigation shows that this incident was a complex multi-stage attack operation, not a single isolated intrusion event, nor a simple phishing attack.
The attackers used a combination of multiple technical means, including social engineering attacks through fake recruitment interviews, inducing downloads of malware, using compromised internal AI tools, compromising employee endpoint devices, and employing advanced transaction authorization techniques.
June 2026 — Supply chain attack. Engineer A from the Wallet DevOps team searched for a popular AI programming tool on a search engine, downloaded a tampered Homebrew installation package, and attempted to install the relevant tool through that package. The Binance security team detected the anomaly, proactively replaced the device, and rotated all related credentials. However, Engineer A's role information and information about relevant colleagues in the wallet infrastructure team had already been exposed to the attackers.
Throughout 2026 — Continuous cyber attacks. Since 2026, the Binance security team has detected and blocked 57 suspected cyber threat incidents related to North Korea. These attacks reflect that state-backed attackers continue to target the cryptocurrency industry. The relevant attack methods include fake recruitment interviews, malware disguised as popular development tools, tampered software packages and browser extensions, fake video conferencing applications, and social engineering attacks designed to steal credentials or deploy remote access malware.
September — Social engineering attack. Software Engineer B received contact information through a legitimate job platform from a person claiming to be a project director. Engineer B's profile on the platform mentioned his experience working at Binance. The other party arranged a round of interviews hosted by a human resources representative, followed by a second round of interviews involving a person claiming to be the CEO of a fictitious company.
In the first round of interviews, the person claiming to be an HR representative conducted a real-time video interview with Software Engineer B. To build trust, the interviewer also shared their social media accounts with Engineer B, including personal photos and videos posted by the interviewer on the platform. This tactic was more sophisticated and deceptive than previously observed social engineering attack methods.
The second round of interviews was conducted through a popular social chat application. Near the end of the interview, Engineer B was asked to download a file called "assignment" on the work computer, which contained a malicious code repository. The malicious code in the repository automatically executed during installation, triggering a series of unauthorized operations.
The malware used sophisticated code obfuscation and detection evasion techniques, including replacing a legitimate development tool component with a malicious version to execute commands and establish communication with external servers controlled by the attackers. At the time, endpoint security protection tools failed to detect this zero-day (0-day) malware. The attackers also took measures to hide malicious activity and erase relevant traces, further increasing the difficulty of detection and subsequent investigation.
The script evaded security detection through code obfuscation techniques and specifically performed the following operations:
October 20 — Using internal AI tools as an attack springboard. The attacker used the compromised computer of Engineer B to further take control of the devices of Wallet DevOps Engineer A and another Wallet Software Engineer C through Binance's internal AI tools. The attacker quickly discovered that the computer of Wallet DevOps Engineer A contained a token with container deployment privileges.
October 29 — Penetrating wallet signing operations. Between 17:15 and 19:56 on October 29, the attacker logged into the computer of Software Engineer C, used credentials stolen from Wallet DevOps Engineer A to deploy a container, and triggered a malicious script, ultimately launching this attack.
Measures Taken
As of November 3, 2026, we have taken the following measures:
Rebuilt the affected wallet system in a completely new environment.
Rebuilt the affected internal AI tools and their access control systems.
Replaced the affected devices.
Revoked the credentials and tokens associated with the affected engineers.
Completed enhanced security scans of all employee devices.
Enhanced AI-based behavioral anomaly detection capabilities.
Strengthened risk control measures for wallet services.
Collaborated with law enforcement agencies, blockchain intelligence firms, and industry partners to track and freeze the affected assets.
As the investigation continues, we will continue to strengthen the relevant security measures. Some of the security measures we have implemented and are implementing will remain confidential to prevent malicious attackers from using the relevant information to undermine our security protection systems.
Follow-up Actions
We are immediately advancing the following work:
- Conduct an independent cybersecurity review
We are engaging independent third-party cybersecurity experts to conduct a comprehensive review of this incident, verify the existing investigation findings, and propose further security improvement recommendations. The scope of the review and the final results will provide the basis for our subsequent remediation work.
- Increase investment in AI security and proactive defense
We will increase investment in areas such as AI-driven threat detection, endpoint protection, development environment security, and behavioral anomaly monitoring.
- Establish a security research fund and promote industry collaboration
We are collaborating with leading AI companies, industry participants, and security firms, and plan to establish a security research fund and carry out specialized research and industry collaboration projects around AI security in blockchain environments.
As the investigation makes further progress, we will continue to proactively disclose relevant information to the public.
