Binance Reveals How the $6.34 Billion Hack Unfolded
Binance has released its initial findings into the October 29, 2026 security incident, revealing how attackers combined social engineering, compromised developer devices, internal AI tooling and unauthorized wallet-signing operations to execute one of the most serious security breaches in the exchange’s history.
The exchange estimates that approximately $6.34 billion in digital assets were impacted. However, Binance says users will not bear the financial loss, confirming that it has set aside more than 100% of the funds required to cover the incident. As of October 31, 98% of the affected token assets had been replenished, with the remaining, less liquid assets still being purchased.
Binance also reported that approximately $2.85 billion in assets had been frozen or intercepted, subject to reconciliation and market price movements. The exchange says it has closed the identified attack entry points, rebuilt or replaced affected systems, and strengthened device controls, wallet-service protections and AI-based behavioural monitoring.
How the Binance Hack Was Executed
The attack began with unauthorized access to Binance’s internal wallet-signing service. Between 20:05 and 20:09 UTC on October 29, five Binance hot wallets transferred 233.46 million XRP to an attacker-controlled address. Hot wallets on Solana and Optimism subsequently transferred approximately 970,500 SOL and 44.2 million OP.
Binance then received an alert about large-volume transfers and began its response. However, the attackers also moved 18,270 BTC from a Binance hot wallet and exploited Ethereum’s EIP-7702 authorization mechanism. This mechanism allows an externally owned account to delegate certain execution rights to a smart contract without revealing its private key.
In this case, malicious authorizations gave an attacker-controlled smart contract partial execution rights over a Binance hot wallet. The attackers submitted 50 signing transactions to manipulate the account nonce and establish these delegations, allowing unauthorized movements to continue independently of Binance’s ordinary withdrawal infrastructure.
This explains why suspending withdrawals was not enough to stop the attack. Binance had to revoke the malicious permissions directly on-chain. Its use of Multi-Party Computation (MPC), which distributes signing authority rather than relying on one conventional private key, added complexity to that process. The team needed to develop a specialized procedure to clear the unauthorized authorizations.
The final unauthorized transfer, involving 2,961.9 ETH, finalized at 23:56 UTC. At 00:10 UTC on October 30, Binance executed a new authorization from its Binance14 hot wallet to the zero address, clearing the EIP-7702 delegation code. The exchange says it observed no further unauthorized transfers after the final movement.
The attack’s preparation was equally concerning. Binance’s investigation identified a June supply-chain incident involving a tampered Homebrew installation downloaded by an engineer seeking an AI coding tool. Although the company detected the anomaly, replaced the device and rotated credentials, the engineer’s role and related colleagues in wallet infrastructure had already been exposed.
In September, another engineer was targeted through a fake recruitment process. An attacker posing as a project director arranged staged interviews, used personal social media material to establish credibility, and eventually instructed the engineer to download a malicious coding assignment onto a work computer. The malware replaced a legitimate development-tool component, executed commands and communicated with an external server while evading endpoint security detection.
Binance’s Response and the Security Lessons
On October 20, the attacker reportedly used the compromised computer and an internal AI tool to gain access to additional employees, including an engineer whose device contained a container deployment permission token. On October 29, the attacker used stolen credentials to access another engineer’s computer, deploy a container and trigger the malicious script that reached Binance’s wallet-signing operations.
The Federal Bureau of Investigation’s latest information identifies North Korea as responsible for the incident, according to Binance. The exchange also disclosed that its security team detected and prevented 57 suspected North Korea-linked cyber threat cases during 2026, illustrating the persistent targeting of cryptocurrency companies by sophisticated actors.
Binance says it has rebuilt the affected wallet environment and internal AI tool, replaced compromised devices, decommissioned related credentials and tokens, and completed enhanced security scans across employee devices. It has also strengthened wallet-service risk controls and expanded AI-based behavioural anomaly detection.
The next phase includes an independent cybersecurity review, increased investment in AI-enabled security and endpoint protection, and plans for a security research fund focused on AI security in blockchain environments. Binance is also working with law enforcement, blockchain intelligence firms and industry partners to trace and freeze affected assets.
The incident exposes a critical weakness in treating exchange security as solely a matter of protecting private keys or stopping withdrawals. Developer devices, recruitment processes, software supply chains, internal AI systems, deployment credentials and on-chain permissions can all become part of the attack surface. Binance’s disclosure provides the industry with a detailed account of how those weaknesses can combine, although its findings remain preliminary and subject to independent review.
About The Author
