Binance security incident explained: What latest report says about attack and recovery
Binance has disclosed details of a major security incident on October 29, 2026, in which approximately $6.34 billion in digital assets were impacted. The cryptocurrency exchange said attackers gained unauthorised access to its internal wallet signing infrastructure and used it to transfer assets outside the normal withdrawal process.In its initial incident report released on November 3, Binance said around $2.85 billion in digital assets had been frozen or intercepted.The exchange also said it would absorb the financial impact of the stolen funds and had set aside more than 100% of the amount required to cover the loss.The investigation points to a sophisticated, multi-stage cyberattack involving fake recruitment interviews, malicious software, compromised employee devices and an internal AI tool.Here is how the attack unfolded, how Binance contained it and what cryptocurrency users should know.What happened in the Binance security breach?Attackers exploited unauthorised access to an internal wallet signing service to initiate cryptocurrency transfers without following Binance's normal withdrawal process.According to the exchange, the transfers involved multiple cryptocurrencies:XRP: 233.46 million tokens transferred from five hot wallets.Solana (SOL): Approximately 970,500 tokens.Optimism (OP): Around 44.2 million tokens.Bitcoin (BTC): 18,270 tokens.Ethereum (ETH): 2,961.9 tokens.The final unauthorised ETH transfer was completed at 23:56 UTC on October 29. Binance said no further unauthorised transfers were observed after it cleared the malicious authorisation on October 30.How did hackers gain access to Binance's systems?Binance's investigation identified a multi-stage operation targeting employees associated with its wallet infrastructure.The sequence began in June 2026, when an engineer downloaded a tampered Homebrew installation while attempting to install an AI coding tool. Although Binance detected the anomaly, replaced the device and rotated related credentials, the attackers had already gained information about the engineer and his colleagues.In September, another software engineer was approached through a job-hunting platform by individuals posing as representatives of a fictitious company. After conducting two rounds of interviews, the attackers asked the engineer to download a coding assignment containing malicious software.The malware compromised a legitimate development tool component, allowing the attackers to execute commands and communicate with an external server.On October 20, the attackers used the compromised computer to exploit an internal AI tool and gain access to other employees' systems. They also discovered a container deployment permission token stored on an engineer's computer.On October 29, using compromised credentials, they accessed another engineer's computer, deployed a container and triggered a malicious script to reach Binance's wallet signing operations.Binance said the FBI had attributed the incident to North Korea, officially known as the Democratic People's Republic of Korea (DPRK).How did hackers bypass Binance's withdrawal security?The attackers exploited Binance's internal wallet signing service and Ethereum's EIP-7702 authorisation mechanism.EIP-7702 allows an externally owned Ethereum account to delegate certain execution rights to a smart contract without revealing its private key.In this case, attackers used the mechanism to give an attacker-controlled smart contract partial execution rights over a Binance hot wallet.They submitted 50 signing transactions to manipulate the account nonce and establish malicious authorisations. This allowed them to move assets independently of Binance's normal withdrawal infrastructure.Consequently, suspending withdrawals alone could not stop all unauthorised transactions.Why did it take time to contain the attack?Binance immediately suspended withdrawals, coordinated with industry partners to freeze affected assets and began revoking the malicious permissions.However, the affected hot wallet used Multi-Party Computation (MPC), a security mechanism that distributes transaction-signing authority across multiple components rather than relying on one private key.This meant Binance could not immediately revoke the malicious authorisations using a single private key. It had to develop a specialised procedure to clear them.The exchange said it executed a new authorisation from its Binance14 hot wallet to the zero address at 00:10 UTC on October 30, removing the malicious EIP-7702 delegation code.How much was affected, and how much has been recovered?Binance reported the following figures in its initial update:ParticularsAmountDigital assets impacted$6.34 billionAssets frozen or intercepted$2.85 billionImpacted token assets replenished98%Financial coverage set asideMore than 100% of the required amountThe 98% replenishment figure was reported as of October 31. Binance said it was purchasing the remaining, less liquid assets.The exchange has clarified that users will not bear the financial impact of the incident.What security measures has Binance taken?Binance said it had rebuilt the affected wallet system and internal AI tool, replaced compromised devices and decommissioned credentials and tokens associated with the affected employees.It has also:Strengthened wallet-service risk controls.Expanded AI-based behavioural anomaly detection.Conducted enhanced security scans across employee devices.Worked with law enforcement and blockchain intelligence firms to trace and freeze assets.The exchange is engaging independent cybersecurity firms to review the incident and validate its findings. It also plans to increase investment in AI-enabled security and establish a security research fund focused on blockchain environments.What should cryptocurrency users learn from the incident?The Binance breach highlights that cryptocurrency security risks extend beyond stolen passwords and private keys. Compromised employee devices, software tools and internal transaction-authorisation systems can also expose digital assets to attacks.Users should take basic precautions:Enable two-factor authentication, preferably using an authenticator app or hardware security key.Avoid downloading software or opening files from unverified sources.Be cautious of unsolicited job offers and interview assignments.Use unique passwords and secure account credentials.Understand the risks of holding digital assets on centralised exchanges.While Binance has committed to covering the financial impact, its investigation remains ongoing.