Binance Discloses Preliminary Security Incident Findings: From Fake Recruiting to Compromised AI Tools, How Did the Hackers Penetrate Layer by Layer?
Tapbit Wire
On November 3, Binance released a preliminary investigation report on the October 29 security incident, disclosing the full course of the attack and the infiltration path used by the attackers behind it. According to the report, the attackers gradually took control of the devices of multiple employees through fake job interviews, malware and compromised internal AI tools, ultimately obtaining wallet signing privileges and using the EIP-7702 authorization mechanism to bypass the normal withdrawal process and transfer assets.
The incident involved total assets of approximately US$6.34 billion. As of the publication of the report, approximately US$2.85 billion in assets had been frozen or intercepted, and 98% of the affected token assets had been replenished. Binance said the relevant losses will be borne by the platform, and it has begun rebuilding the affected systems, strengthening security protections, and engaging an independent third party to conduct further review. The report also noted that the latest information from the U.S. Federal Bureau of Investigation shows that North Korea is responsible for the incident.
The following is the full text:
On October 29, 2026, Binance suffered a serious and highly sophisticated security incident. This incident should not have happened, and we deeply apologize for the concern, business disruption and uncertainty it caused to users, partners and the entire industry.
Protecting users is always our top priority. The financial losses caused by the stolen funds will be borne by Binance and will not be passed on to users. We have reserved funds exceeding 100% of the loss amount to cover the losses. As of October 31, 2026, 98% of the affected token assets have been replenished, and users can verify this via the Proof of Reserves page. For the portion of less liquid assets that has not yet been replenished, we are in the process of purchasing them.
The total digital assets involved in this incident amounted to approximately US$6.34 billion. As of the publication of this report, approximately US$2.85 billion in digital assets had been frozen or intercepted; the exact amount still requires further verification and may be affected by market price fluctuations.
We immediately took action to contain the impact of the incident and strengthen the security of the affected systems. All confirmed intrusion entry points exploited by the attackers have been closed, and the systems involved in the attack path have been rebuilt or replaced. In addition, we have further tightened device control measures, strengthened risk controls for wallet services, and expanded AI-based anomalous behavior detection capabilities.
This report is a preliminary investigation report and covers the situation as we currently understand it and the security improvements already completed. The investigation is still ongoing, and the relevant findings will be subject to further independent review. To prevent malicious attackers from using the information to plan attacks, some technical details will remain confidential. We are engaging an independent security firm to conduct further review.
The latest information released by the U.S. Federal Bureau of Investigation (FBI) indicates that the Democratic People's Republic of Korea (DPRK) is responsible for this incident.
We have chosen to publish this preliminary report because only when the entire industry learns from these lessons together can security standards continue to improve.
What Happened on October 29
The attack unfolded rapidly across multiple networks.
The attackers used unauthorized access to an internal wallet signing service to initiate transactions outside the normal withdrawal process.
Between 20:05 and 20:09 UTC, five Binance hot wallets transferred 233.46 million XRP to addresses controlled by the attackers.
Subsequently, Binance hot wallets deployed on the Solana and Optimism networks transferred approximately 970,500 SOL and 44.2 million OP, respectively, to addresses controlled by the attackers.
After that, Binance received an internal alert about a large asset transfer and immediately launched an investigation.
A Binance hot wallet then transferred 18,270 BTC to an address controlled by the attackers.
The attackers then used the signing service to further abuse Ethereum's EIP-7702 authorization mechanism.
EIP-7702 allows an account to delegate partial execution authority to a smart contract without exposing its private key. In this incident, the attackers used this mechanism to give a smart contract they controlled partial execution authority over one of Binance's hot wallets.
Binance immediately activated multiple emergency measures, including suspending withdrawals to limit further outflows of funds, coordinating with partners to freeze affected tokens, and taking measures to revoke unauthorized permissions. Through these actions, a total of US$2.85 billion in assets was frozen.
However, suspending withdrawals alone was not enough to stop all unauthorized asset transfers. The malicious EIP-7702 authorization already existed on-chain and operated independently of Binance's normal withdrawal infrastructure.
The attackers submitted a total of 50 signed transactions, establishing malicious delegation authorizations by manipulating account nonces (transaction sequence numbers). Once these authorizations were established, the attackers were able to bypass Binance's normal withdrawal infrastructure and continue transferring assets. Binance had to initiate additional transactions to revoke these on-chain authorizations.
The overall process of regaining control of assets also faced other technical complexities. Because the hot wallets involved use multi-party computation (MPC) technology, there was no single private key that could be directly used to immediately revoke the malicious EIP-7702 authorization. To address this, the team needed to specifically develop and execute a special revocation process, which also required additional time.
In addition, suspending withdrawals and shutting down hot wallet services did not automatically invalidate authorizations that already existed on-chain.
These challenges extended the time required to fully bring the unauthorized asset transfers under control. We are reviewing the incident's emergency response process, the scope of signing policies and hot wallet controls, and looking for opportunities to further improve the speed of threat response in the future.
The last unauthorized transfer was 2,961.9 ETH, which was finally confirmed on-chain at 23:56 UTC. The transaction had previously been broadcast and was pending before it was finally confirmed. No further unauthorized transfers have been observed since then.
At 00:10 UTC on October 30, 2026, Binance executed a new authorization transaction from the Binance14 hot wallet to the zero address, clearing the EIP-7702 delegation code.
How the Attack Was Prepared
The current investigation shows that this incident was a complex, multi-stage attack operation, not a single isolated intrusion or a simple phishing attack.
The attackers combined multiple technical methods, including social engineering through fake job interviews, luring victims into downloading malware, exploiting compromised internal AI tools, compromising employee endpoint devices, and using advanced transaction authorization techniques.
June 2026 — Supply chain attack. Engineer A from the Wallet DevOps team searched for a popular AI coding tool on a search engine, downloaded a tampered Homebrew installer package, and attempted to install the relevant tool through that package. Binance's security team detected the anomaly, proactively replaced the device and rotated all related credentials. However, Engineer A's role information and information about relevant colleagues in the wallet infrastructure team had already been exposed to the attackers.
Throughout 2026 — Persistent cyberattacks. Since 2026, Binance's security team has detected and blocked 57 suspected cyber threat incidents linked to North Korea. These attacks reflect that state-backed attackers continue to target the cryptocurrency industry. Related attack methods include fake job interviews, malware disguised as popular developer tools, tampered software packages and browser extensions, fake video conferencing applications, and social engineering attacks designed to steal credentials or deploy remote-access malware.
September — Social engineering attack. Software Engineer B received a contact message via a legitimate job platform from a person claiming to be a project director. Engineer B's profile on that platform mentioned previous experience working at Binance. The person arranged a first-round interview hosted by a human resources representative, followed by a second-round interview involving a person claiming to be the CEO of a fictitious company.
During the first interview, the person posing as an HR representative conducted a live video interview with Software Engineer B. To build trust, the interviewer also shared their social media accounts with Engineer B, which included personal photos and videos posted by the interviewer on those platforms. This tactic is more sophisticated and deceptive than social engineering methods observed in the past.
The second interview was conducted through a popular social chat application. Near the end of the interview, Engineer B was asked to download a file called "homework" on their work computer, which contained a malicious code repository. The malicious code in the repository executed automatically during installation, triggering a series of unauthorized operations.
The malware used sophisticated code obfuscation and detection-evasion techniques, including replacing a legitimate developer tool component with a malicious version to execute commands and establish communication with an external server controlled by the attackers. At the time, endpoint security protection tools failed to detect this zero-day malware. The attackers also took measures to conceal malicious activity and erase related traces, further increasing the difficulty of detection and subsequent investigation.
The script evaded security detection through code obfuscation techniques and specifically performed the following operations:
October 20 — Using internal AI tools as an attack springboard. Using the compromised computer of Engineer B, the attackers further took control of the devices of Wallet DevOps Engineer A and another wallet software engineer, C, through Binance's internal AI tools. The attackers quickly discovered that a token with container deployment permissions was stored on Wallet DevOps Engineer A's computer.
October 29 — Penetrating wallet signing operations. Between 17:15 and 19:56 on October 29, the attackers logged into Software Engineer C's computer, used credentials stolen from Wallet DevOps Engineer A to deploy a container, and triggered a malicious script, ultimately launching the attack.
Measures Taken
As of November 3, 2026, we have taken the following measures:
Rebuilt the affected wallet systems in a completely new environment.
Rebuilt the affected internal AI tools and their access control systems.
Replaced the affected devices.
Revoked credentials and tokens associated with the affected engineers.
Completed enhanced security scans of all employee devices.
Enhanced AI-based anomalous behavior detection capabilities.
Strengthened risk control measures for wallet services.
Collaborated with law enforcement agencies, blockchain intelligence firms and industry partners to track and freeze affected assets.
As the investigation continues, we will continue to strengthen relevant security measures. Some security measures we have implemented and are implementing will remain confidential to prevent malicious attackers from using the information to undermine our security defenses.
Next Steps
We are immediately advancing the following work:
Conduct an independent cybersecurity review
We are engaging independent third-party cybersecurity experts to conduct a comprehensive review of this incident, verify the existing investigation findings and propose further security improvement recommendations. The scope of the review and its final results will provide the basis for our subsequent remediation work.
Increase investment in AI security and proactive defense
We will increase investment in areas such as AI-driven threat detection, endpoint protection, development environment security and anomalous behavior monitoring.
Establish a security research fund and promote industry collaboration
We are working with leading AI companies, industry participants and security firms, and plan to establish a security research fund and carry out specialized research and industry collaboration projects focused on AI security in blockchain environments.
As the investigation makes further progress, we will continue to proactively disclose relevant information to the public.
