Binance explains how it was hacked: tampered packages, a fake job interview and an internal AI tool

This is the first official account of the October 29 attack. Binance puts the impact at about $6.34 billion and says some $2.85 billion has been frozen or intercepted, “subject to reconciliation and price volatility”.

The chain of events began in June, when a wallet operations engineer installed a tampered Homebrew package.

In September, another engineer fell for a fake job interview involving a malicious repository.

On October 20, the attacker used an internal AI tool to reach other engineers, and on October 29 launched the script from one of their computers.

With access to the internal wallet signing service, the attacker used EIP-7702 to grant a contract under their control partial permissions over a hot wallet. Binance cites the FBI alert attributing the attack to North Korea and says it detected 57 suspicious cases linked to that country in 2026.

According to the report, as of October 31 it had replenished 98% of the affected tokens. It announces an independent cybersecurity audit, more AI-based detection and a security research fund.

On October 29, 2026, Binance suffered a serious and highly sophisticated security incident. This should not have happened, and we apologize for the concern, inconvenience and uncertainty it caused our users, partners and the industry at large.

Our primary responsibility is to protect users. Binance will bear the financial impact of the stolen funds, not our users. We have already set aside more than 100% of the funds needed to cover the loss. As of October 31, 2026, 98% of the affected tokens have been replenished and can be verified on our Proof of Reserves page. We are in the process of acquiring the remaining tokens, which are less liquid.

The incident affected digital assets worth approximately $6.34 billion. As of this update, digital assets worth approximately $2.85 billion have been frozen or intercepted, subject to reconciliation and market price volatility.

We took immediate steps to contain the incident and strengthen the systems involved. The entry points identified as used in the attack have been blocked. The systems affected by the attack have been rebuilt or replaced. We have also implemented stricter device controls, improved wallet service risk controls and expanded AI-based behavioral anomaly detection.

This is our initial report. It sets out current information and the improvements we have already implemented. The investigation is ongoing and our findings will be subject to independent review. Some technical details will remain confidential to prevent malicious actors from using them to plan attacks. We are working with independent security firms on a more thorough review. 

The latest information published by the Federal Bureau of Investigation (FBI) indicates that the Democratic People’s Republic of Korea is responsible for this incident.

We are sharing this initial report because security improves when the industry learns together.

What happened on October 29?

The attack spread rapidly across several networks.

The attacker leveraged unauthorized access to an internal wallet signing service to initiate transactions outside the normal withdrawal process.

Between 20:05 UTC and 20:09 UTC , five Binance hot wallets sent 233.46 million XRP to an attacker-controlled address.

Binance hot wallets on Solana and Optimism sent approximately 970,500 SOL and 44.2 million OP to attacker-controlled addresses.

Binance subsequently received an internal alert about high-volume transfers and immediately began investigating.

Binance’s digital wallet sent 18,270 BTC to an attacker-controlled address. 

The attacker used the signing service to exploit Ethereum’s EIP-7702 authorization mechanism. EIP-7702 allows an account to delegate certain execution rights to a smart contract without exposing the private key. In this case, the attacker used that mechanism to grant a smart contract under their control partial execution rights over a Binance hot wallet. 

Binance immediately implemented various containment measures, including suspending withdrawals to restrict fund outflows, coordinating with partners to freeze the affected tokens and revoking unauthorized permissions. These measures froze a total of $2.85 billion in assets.

However, suspending withdrawals alone was not enough to stop all unauthorized asset movements. The malicious EIP-7702 authorizations existed on the blockchain and operated independently of Binance’s regular withdrawal infrastructure. The attackers sent 50 signing transactions to manipulate the account nonce and establish malicious delegation authorizations. Once established, these authorizations allowed them to keep moving assets independently of Binance’s regular withdrawal infrastructure. Binance needed additional transactions to revoke these authorizations on the blockchain.

The containment process involved additional technical complexities. Because the hot wallet used multi-party computation (MPC), there was no single private key that could be used to immediately revoke the malicious EIP-7702 authorizations. The team therefore developed and executed a specialized procedure to revoke those authorizations, which required additional time. In addition, suspending withdrawals and shutting down hot wallet services did not automatically invalidate the existing authorizations on the blockchain.

These challenges extended the time needed to fully contain the unauthorized asset movements. We are reviewing the incident response process, underwriting policy coverage and digital wallet controls, and identifying opportunities to further strengthen our ability to respond rapidly to future threats.

The last unauthorized transfer of 2,961.9 ETH was completed on the blockchain at 23:56 UTC . The transaction had been broadcast earlier and remained pending before being finalized. No further unauthorized transfers were observed afterwards.

At 00:10 UTC on October 30, 2026 , Binance executed a new authorization from the Binance14 hot wallet to the zero address, clearing the EIP-7702 delegation code.

Preparation of the attack 

Our current investigation indicates this was a sophisticated, multi-phase campaign. It was not an isolated breach or a simple phishing incident. The attackers combined various techniques, including social engineering through fake job interviews, malicious software downloads, compromised internal AI tools, endpoint compromise and an advanced transaction authorization method.

• June ​​2026: Supply chain attack. Engineer A from the Wallet Development and Operations team downloaded a tampered Homebrew installation to install a popular AI coding tool after searching for it on a search engine. Our security team detected the anomaly, replaced the device and rotated all related credentials as a precaution. However, the role of Engineer A and those of their colleagues on our wallet infrastructure team were exposed to the hacker.
• Throughout 2026, Binance’s security team detected and prevented 57 cases of cyber threats allegedly linked to North Korea. These attempts reflect the persistent threat posed by state-sponsored actors targeting the crypto industry. The techniques used include fraudulent job interviews, malware disguised as popular developer tools, compromised software packages and browser extensions, fake video conferencing apps and social engineering campaigns designed to steal credentials or deploy remote access malware.
• September 2026: social engineering. Software Engineer B was contacted through a legitimate job search platform by a person posing as a project manager. Software Engineer B had a profile on the platform mentioning their experience at Binance. The supposed project manager arranged a first interview with a human resources representative, followed by a second interview with a person claiming to be the CEO of a fictitious company.
  • In the first round, the supposed HR representative conducted a live video interview with Software Engineer B. To gain their trust, the interviewer shared their social media account, including personal photos and videos posted on the platform. This tactic proved more sophisticated and deceptive than previously seen social engineering techniques.
  • The second interview took place through a popular chat app. Near the end of the interview, Engineer B was instructed to download an “assignment” containing a malicious code repository onto their work computer. The repository contained malicious code that ran during the installation process, initiating a series of unauthorized activities.
  • The malware employed sophisticated obfuscation and evasion techniques, including replacing a legitimate component of a development tool with a malicious version to execute commands and establish communication with an external attacker-controlled server. At the time, endpoint security protection tools did not detect the zero-day malware. The attacker also took steps to conceal the malicious activity and remove traces of the intrusion, making subsequent detection and investigation harder.
  • The script executed the following steps, applying obfuscation techniques to evade security detection.

CREATE /opt/homebrew/Cellar/pyenv/2.8.0/libexec/pyenv_  

MODIFY pyenv_ → 3,414 B  

DELETE …/libexec/pyenv (3,344 B) ← delete the valid pyenv

RENAME pyenv_ → pyenv (3,414 B) ← replace it with a malicious version

DELETE /opt/homebrew/bin/pyenv (3,414 B)

ln (create a new symbolic link) + spawn zsh

• October 20, 2026: an internal AI tool used as a pivot point. The attacker leveraged Engineer B’s compromised computer and used an internal AI tool to gain control of Wallet DevOps Engineer A and another Wallet Software Engineer C. The attacker soon discovered that Wallet DevOps Engineer A had a container deployment permission token on their computer.
• October 29, 2026: unauthorized access to wallet signing operations. On October 29, between 17:15 and 19:56, the attacker accessed Software Engineer C’s computer, used the credentials stolen from Wallet Development Engineer A, deployed a container and triggered a malicious script to launch the attack.

What we have done

As of November 3, 2026, we have taken the following measures:

• Rebuilt the affected wallet system in a new environment.
• Rebuilt the affected internal AI tool and access controls.
• Replaced the affected devices.
• Deactivated credentials and tokens related to the affected engineers.
• Completed enhanced security scans on all employee devices.
• Improved AI-based behavioral anomaly detection.
• Strengthened wallet service risk controls.
• Worked with law enforcement, blockchain intelligence firms and industry partners to trace and freeze the affected assets.

We will continue strengthening our measures as the investigation progresses. We have implemented and are implementing various security measures that will remain confidential to prevent malicious actors from compromising our security.

Additional actions

We will take the following measures immediately.

1. Independent cybersecurity review

We have engaged independent cybersecurity experts to conduct a thorough review of the incident, validate our findings and recommend additional measures. The scope and conclusions of that review will inform our ongoing mitigation efforts.

2. Increased investment in AI security and prevention.

We are increasing investment in AI-based detection, endpoint protection, development environment security and behavioral anomaly monitoring.

3. Security research fund and industry initiatives.

We are working to create a security research fund and specific initiatives with leading AI companies, industry participants and security firms focused on AI security in blockchain environments