Binance Says 98% of $6.34 Billion Stolen Assets Replenished, Details Multi-Stage Attack

Binance said about $6.34 billion of digital assets were affected in the Oct. 29 incident, and that 98% of the impacted tokens had been replenished as of Oct. 31, verifiable on its proof-of-reserves page, according to its initial findings report. The exchange said it has set aside more than 100% of the funds needed to cover the loss and that users will not bear the financial impact. Roughly $2.85 billion has been frozen or intercepted so far, subject to reconciliation and market price moves. Binance apologised, saying the incident should not have happened. The attacker used unauthorized access to an internal wallet signing service to start transactions outside the normal withdrawal process. Between 20:05 and 20:09 UTC, five hot wallets sent 233.46 million XRP to an attacker-controlled address; Solana and Optimism wallets sent about 970,500 SOL and 44.2 million OP, and an 18,270 BTC transfer followed. The attacker then exploited Ethereum's EIP-7702 authorization mechanism to give a malicious contract partial execution rights over a hot wallet, submitting 50 signing transactions to manipulate the account nonce and lock in the delegations. Suspending withdrawals and shutting hot wallet services did not automatically invalidate the on-chain authorizations. Because the wallet used multi-party computation, there was no single private key to revoke them, and a specialized procedure took additional time. The final unauthorized transfer of 2,961.9 ETH finalized at 23:56 UTC; at 00:10 UTC on Oct. 30, Binance cleared the EIP-7702 delegation code from its Binance14 hot wallet. The campaign was multi-stage rather than a single breach. In June, an engineer downloaded a tampered Homebrew installation while setting up an AI coding tool; Binance detected it, replaced the device and rotated credentials, but the wallet team was exposed. In September, a fake recruiter on a job platform ran video interviews and sent an "assignment" repository carrying 0-day malware undetected by endpoint tools. On Oct. 20, the attacker used an internal AI tool as a springboard to reach a container deployment token, and on Oct. 29 between 17:15 and 19:56 deployed a container to trigger the attack. Binance said it blocked 57 suspected North Korea-linked threats this year. The FBI says the DPRK was responsible. Binance said it has rebuilt the affected wallet system and internal AI tool, replaced devices, decommissioned related credentials and tokens, scanned all employee devices and expanded AI-based behavioural anomaly detection. It is commissioning an independent review, increasing investment in AI security and prevention, and working to set up a security research fund with AI and industry partners.