Independent record. Not associated with, endorsed by or operated by Binance. This site is read-only: there is nothing to sign in to, pay for or connect.
An independent record of the October 2026 Binance hack
This line is our short summary of the quote below. The quote is the evidence.
20 October, 2026 — use of an internal AI tool as a springboard. The attacker leveraged the compromised computer of engineer B and used an internal AI tool to gain control over the Wallet DevOps Engineer A and another Wallet Software Engineer C. The attacker soon discovered Wallet DevOps Engineer A had a container deployment permission token on his computer.
From this source: 29 October 2026 Binance Security Incident: Initial Findings and Response Update (Binance Blog, archived copy captured 2026-11-05), with all of its statements.
We are working on establishing a security research fund and targeted initiatives with leading AI companies, industry participants and security firms focused on AI security in blockchain environments.
We are engaging independent third-party cybersecurity experts to conduct a comprehensive review of the incident, validate our findings and recommend additional measures.
As of Nov 3, 2026, we have taken the following actions: * Rebuilt the affected wallet system in a new environment. * Rebuilt the affected internal AI tool and access controls. * Replaced affected devices. * Decommissioned credentials and tokens related to affected engineers.
Binance then received an internal alert regarding large-volume transfers and immediately began investigating.
Because the hot wallet used Multi-Party Computation (MPC), there was no single private key that could be used to immediately revoke the malicious EIP-7702 authorizations. The team therefore developed and executed a specialized procedure to revoke these authorizations, which required additional time.