Officialclaim Binance published an update titled: Security Incident | Recovery Update #8: Withdrawals for More Assets to Reopen (2026-11-05)
Binance. Original
Reportedclaim Cointelegraph reported that the attackers behind the $6.3 billion Binance hack have moved about 81% of the stolen Solana (SOL) as they continue laundering assets through the cross-chain swap protocol THORChain.
Cointelegraph. Original
Officialclaim Binance said it has taken a new Proof of Reserve (PoR) snapshot at 2026-11-04 00:00 (UTC) that now covers 44 tokens, up from 10 in the previous snapshot, and is available on its PoR website.
Binance. Original
Officialclaim Binance said generating the full zero-knowledge proof is expected to take approximately 50 to 60 hours due to the computational workload, and that once the proof is generated, users holding any of the covered tokens will be able to independently verify that their balances are at least 1:1 backed.
Binance. Original
Reportedclaim Halborn reported that Binance says that because Binance 14 uses multi-party computation there was no single private key with which to sign a revocation, and the team developed and executed a specialized procedure to produce the authorization to the zero address.
Halborn. Original
Reportedclaim japantimes.co.jp reported that the hackers used an internal AI tool to gain access, Binance’s report said, without specifying what the tool was or how it was used to gain control of the employees’ laptops.
japantimes.co.jp. Original
Reportedclaim southcarolinapublicradio.org reported that Binance said in its assessment: This was more advanced and deceptive than previously seen social engineering approaches.
southcarolinapublicradio.org. Original
Officialclaim Binance stated that it will absorb the financial impact of the stolen funds and has set aside more than 100% of the funds required to cover the loss.
Binance. Original
Officialclaim Binance reported that as of 31 October 2026, 98% of the impacted token assets have been replenished and are verifiable on its Proof of Reserves page.
Binance. Original
Officialclaim Binance stated that approximately USD 6.34 billion in digital assets were impacted by the incident.
Binance. Original
Officialclaim Binance reported that approximately USD 2.85 billion in digital assets have been frozen or intercepted.
Binance. Original
Officialclaim Binance noted that the Federal Bureau of Investigation indicates that the Democratic People’s Republic of Korea is responsible for the incident.
Binance. Original
Officialclaim Binance stated that the attacker exploited unauthorized access to an internal wallet signing service to initiate transactions outside the normal withdrawal process.
Binance. Original
Officialclaim Binance reported that between 20:05 UTC and 20:09 UTC, five Binance hot wallets sent 233.46 million XRP to an attacker-controlled address.
Binance. Original
Officialclaim Binance stated that Binance hot wallets on Solana and Optimism sent approximately 970,500 SOL and 44.2 million OP to attacker-controlled addresses.
Binance. Original
Officialclaim Binance reported that a Binance hot wallet sent 18,270 BTC to an attacker-controlled address.
Binance. Original
Officialclaim Binance stated that the attacker used the signing service to exploit Ethereum’s EIP-7702 authorization mechanism to give an attacker-controlled smart contract partial execution rights over a Binance hot wallet.
Binance. Original
Officialclaim Binance reported that the final unauthorized transfer of 2,961.9 ETH finalised on-chain at 23:56 UTC.
Binance. Original
Officialclaim Binance stated that at 00:10 UTC on 30 October 2026, it executed a new authorization from the Binance14 hot wallet to the zero address to clear the EIP-7702 delegation code.
Binance. Original
Officialclaim Binance reported that as of November 3, 2026, it had worked with law enforcement, blockchain intelligence firms, and industry partners to trace and freeze affected assets.
Binance. Original
Officialclaim Binance stated that the attacker used the compromised computer of engineer B and an internal AI tool to gain control over Wallet DevOps Engineer A and another Wallet Software Engineer C on 20 October 2026.
Binance. Original
Officialclaim Binance stated that on 29 October 2026 between 17:15 and 19:56, the attacker logged onto Software Engineer C’s computer, used stolen credentials, deployed a container, and triggered a malicious script to launch the attack.
Binance. Original
Officialclaim Binance said in its initial incident report that the 29 October security incident should not have happened, and apologised to its users, partners and the wider industry.
Binance. Original
Officialclaim Binance called its incident report an initial report, said the investigation remains ongoing and its findings will be subject to further independent review, and said some technical details will remain confidential.
Binance. Original
Officialclaim Binance said the entry points identified as having been used in the attack have been closed and that systems touched in the attack path have been rebuilt or replaced.
Binance. Original
Officialclaim Binance said its containment measures included suspending withdrawals, coordinating with partners to freeze affected tokens and taking steps to revoke unauthorized permissions, and that these efforts froze a total of $2.85 billion in assets.
Binance. Original
Officialclaim Binance said its investigation indicates the attack was a sophisticated, multi-stage campaign and not a single isolated breach or a simple phishing incident, combining social engineering by fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise and an advanced transaction-authorisation method.
Binance. Original
Officialclaim Binance said that in June 2026 a Wallet DevOps engineer it calls Engineer A downloaded a tampered Homebrew installation while installing an AI coding tool; its security team replaced the device and rotated the related credentials, but the engineer's role and wallet-infrastructure colleagues were exposed to the hacker.
Binance. Original
Officialclaim Binance said its security team detected and prevented 57 suspected North Korea-linked cyber threat cases during 2026.
Binance. Original
Officialclaim Binance said that in September 2026, in what it calls social engineering, a software engineer it calls Engineer B was contacted on a legitimate job-hunting platform by someone posing as a Project Director, who arranged a first-round interview with an HR representative and a second with someone claiming to be the CEO of a fictitious company.
Binance. Original
Officialclaim Binance said that near the end of the second interview, held in a popular social chat app, Engineer B was instructed to download an "assignment" containing a malicious code repository onto his work computer, and that the malicious code executed during the setup process.
Binance. Original
Officialclaim Binance said the 0-day malware was not detected by the endpoint security protection tools at the time.
Binance. Original
Officialclaim Binance said suspending withdrawals alone could not stop all unauthorized asset movements, as the malicious EIP-7702 authorizations existed on-chain and operated independently of its normal withdrawal infrastructure, and that the attackers submitted 50 signing transactions to manipulate the account nonce and establish malicious delegation authorizations.
Binance. Original
Officialclaim Binance said that because the hot wallet used Multi-Party Computation (MPC), there was no single private key that could be used to immediately revoke the malicious EIP-7702 authorizations, so its team developed and executed a specialized revocation procedure, which required additional time.
Binance. Original
Officialclaim Binance said it received an internal alert regarding large-volume transfers and immediately began investigating.
Binance. Original
Officialclaim Binance said that as of 3 November it had rebuilt the affected wallet system in a new environment, rebuilt the affected internal AI tool and access controls, replaced affected devices and decommissioned credentials and tokens related to the affected engineers.
Binance. Original
Officialclaim Binance said it is engaging independent third-party cybersecurity experts to conduct a comprehensive review of the incident, validate its findings and recommend additional measures.
Binance. Original
Officialclaim Binance said it is working on establishing a security research fund and targeted initiatives with AI companies, industry participants and security firms focused on AI security in blockchain environments.
Binance. Original