Binance Blog published a new article, sharing initial findings and response measures after a security incident on 29 October 2026. Binance said approximately USD 6.34 billion in digital assets were impacted, and that it would absorb the financial loss rather than pass it to users. The company said it had set aside more than 100% of the funds needed to cover the loss. As of 31 October 2026, 98% of impacted token assets had been replenished and were verifiable through its Proof of Reserves; Binance was purchasing the remaining, less liquid assets. Approximately USD 2.85 billion had been frozen or intercepted, subject to reconciliation and market price volatility. The company said attackers gained unauthorized access to an internal wallet-signing service and moved assets across several networks. Between 20:05 UTC and 20:09 UTC, five hot wallets sent 233.46 million XRP to an attacker-controlled address. Hot wallets also transferred approximately 970,500 SOL, 44.2 million OP and 18,270 BTC. The attacker then exploited Ethereum’s EIP-7702 authorization mechanism to give a malicious smart contract partial execution rights over a Binance hot wallet. The final unauthorized transfer, 2,961.9 ETH, finalized on-chain at 23:56 UTC. At 00:10 UTC on 30 October 2026, Binance cleared the delegation code with a new authorization. The company said no further unauthorized transfers were observed after the final transfer.
Binance said suspending withdrawals, coordinating with partners to freeze tokens and revoking permissions helped contain the incident, but existing on-chain authorizations could continue operating independently of its withdrawal systems. Because the affected hot wallet used multi-party computation, the response team had to develop a specialized process to revoke the authorizations. Binance said it closed identified attack entry points, rebuilt or replaced affected systems, tightened device controls, strengthened wallet-service risk controls and expanded AI-based anomaly detection. Its investigation described a multistage campaign involving social engineering, malicious downloads, compromised internal AI tooling, endpoint compromise and transaction authorization techniques. Binance reported a supply-chain incident in June 2026 and social engineering targeting an engineer in September. On 20 October, the attacker allegedly used a compromised computer and an internal AI tool to reach other employees; on 29 October, the attacker used stolen credentials to deploy a container and trigger the attack. As of Nov 3, 2026, Binance said it had rebuilt affected systems and the internal AI tool, replaced devices, revoked related credentials and tokens, scanned employee devices, and worked with law enforcement, blockchain intelligence firms and industry partners. The company said the investigation remains ongoing, the FBI’s latest information attributed responsibility to the Democratic People’s Republic of Korea, and independent cybersecurity experts would review the findings. Binance also plans increased investment in AI-enabled security and work on a security research fund and industry initiatives.
Alex
