29 October 2026 Binance Security Incident: Initial Findings and Response Update (Binance Blog, archived copy captured 2026-11-05)

29 October, 2026 — reach into wallet signing operations. On 29 October between 17:15 and 19:56, the attacker logged onto Software Engineer C’s computer, used the credentials stolen from Wallet DevOps Engineer A, deployed a container, and triggered a malicious script to launch the attack.

Between 20:05 UTC and 20:09 UTC, five Binance hot wallets sent 233.46 million XRP to an attacker-controlled address.

The final unauthorized transfer of 2,961.9 ETH finalised on-chain at 23:56 UTC. The transaction had previously been broadcast and remained pending before subsequently finalising. No further unauthorised transfers were observed after.

At 00:10 UTC on 30 October 2026, Binance executed a new authorization from the Binance14 hot wallet to the zero address, clearing the EIP-7702 delegation code.

Our first responsibility is to protect users. Binance will absorb the financial impact of the stolen funds, not our users. We have already set aside more than 100% of the funds required to cover the loss.

As of 31 October 2026, 98% of the impacted token assets have been replenished and are verifiable on our Proof of Reserves page.

Approximately USD 6.34 billion in digital assets were impacted by the incident.

As of this update, approximately USD 2.85 billion in digital assets have been frozen or intercepted, subject to reconciliation and market price volatility.

The latest information released by the Federal Bureau of Investigation indicates that the Democratic People’s Republic of Korea is responsible for this incident.

The attacker exploited unauthorized access to an internal wallet signing service to initiate transactions outside the normal withdrawal process.

Binance hot wallets on Solana and Optimism sent approximately 970,500 SOL and 44.2 million OP to attacker-controlled addresses.

Binance hot wallet sent 18,270 BTC to an attacker-controlled address.

The attacker then used the signing service to exploit Ethereum’s EIP-7702 authorization mechanism. EIP-7702 allows an account to delegate certain execution rights to a smart contract without exposing the private key. In this case, the attacker used that mechanism to give an attacker-controlled smart contract partial execution rights over a Binance hot wallet.

As of Nov 3, 2026, we have taken the following actions: * Rebuilt the affected wallet system in a new environment. * Rebuilt the affected internal AI tool and access controls. * Replaced affected devices. * Decommissioned credentials and tokens related to affected engineers. * Completed enhanced security scans across all employee devices. * Enhanced AI-based behavioural anomaly detection. * Strengthened wallet-service risk controls. * Worked with law enforcement, blockchain intelligence firms and industry partners to trace and freeze affected assets.

20 October, 2026 — use of an internal AI tool as a springboard. The attacker leveraged the compromised computer of engineer B and used an internal AI tool to gain control over the Wallet DevOps Engineer A and another Wallet Software Engineer C. The attacker soon discovered Wallet DevOps Engineer A had a container deployment permission token on his computer.

On 29 October 2026, Binance experienced a serious and highly sophisticated security incident. This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry.

This is our initial report. It covers what we know today and what we have already improved. The investigation remains ongoing and our findings will be subject to further independent review. Some technical details will remain confidential to prevent malicious actors from using them to plan attacks.

The entry points identified as having been used in the attack have been closed. Systems touched in the attack path have been rebuilt or replaced.

Binance immediately initiated multiple containment measures, including suspending withdrawals to restrict further outflows, coordinating with partners to freeze affected tokens, and taking steps to revoke unauthorized permissions. These efforts froze a total of $2.85 billion in assets.

Our current investigation indicates that this was a sophisticated, multi-stage campaign. It was not a single isolated breach or a simple phishing incident. The attackers combined a range of techniques, including social engineering by fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise, and an advanced transaction-authorisation method.

June 2026 — Supply chain attack. Engineer A from Wallet DevOps downloaded a tampered Homebrew installation in order to install a popular AI coding tool after searching for it on a search engine. Our security team detected the anomaly, replaced the device, and rotated all related credentials as a proactive security action. However, Engineer A’s role and his related colleagues on our wallet infrastructure team was exposed to the hacker.

Throughout 2026, Binance's security team detected and prevented 57 suspected North Korea-linked cyber threat cases.

September 2026 — social engineering. Software Engineer B was contacted through a legitimate job-hunting platform by an individual posing as a Project Director. Software Engineer B had a profile on the platform that referenced his experience at Binance. The purported Project Director arranged a first-round interview with a HR representative, followed by a second-round interview with an individual claiming to be the CEO of a fictitious company.

The second interview was conducted in a popular social chat app, near the end of the interview, Engineer B was instructed to download an “assignment” containing a malicious code repository onto his work computer. The repository contained malicious code that executed during the setup process, initiating a series of unauthorized activities.

The 0-day malware was not detected by the endpoint security protection tools at the time.

However, suspending withdrawals alone could not stop all unauthorized asset movements. The malicious EIP-7702 authorizations existed on-chain and operated independently of Binance’s normal withdrawal infrastructure.The attackers submitted 50 signing transactions to manipulate the account nonce and establish malicious delegation authorizations.

Because the hot wallet used Multi-Party Computation (MPC), there was no single private key that could be used to immediately revoke the malicious EIP-7702 authorizations. The team therefore developed and executed a specialized procedure to revoke these authorizations, which required additional time.

Binance then received an internal alert regarding large-volume transfers and immediately began investigating.

As of Nov 3, 2026, we have taken the following actions: * Rebuilt the affected wallet system in a new environment. * Rebuilt the affected internal AI tool and access controls. * Replaced affected devices. * Decommissioned credentials and tokens related to affected engineers.

We are engaging independent third-party cybersecurity experts to conduct a comprehensive review of the incident, validate our findings and recommend additional measures.

We are working on establishing a security research fund and targeted initiatives with leading AI companies, industry participants and security firms focused on AI security in blockchain environments.