Binance said an Oct. 29 security breach led to unauthorized transfers of roughly $6.34 billion in digital assets after attackers compromised internal wallet-signing systems, with the exchange reporting that it had frozen or intercepted about $2.85 billion and restored 98% of affected token balances by Oct. 31.
The incident, which Binance attributed to a multi-stage intrusion involving supply-chain malware, social engineering and compromised employee devices, reached beyond a conventional phishing attack. Attackers gained access to the systems supporting hot-wallet operations and used an Ethereum authorization feature to sustain transfers outside the exchange's usual withdrawal controls.
Binance said it had reserved funds exceeding the reported loss and was purchasing remaining low-liquidity assets required to complete customer balance restoration. U.S. federal investigators attributed responsibility to the Democratic People's Republic of Korea, according to information included in Binance's account of the incident.
Transfers struck five major hot-wallet networks
The first identified unauthorized transfers occurred between 20:05 and 20:09 UTC on Oct. 29, when five Binance hot wallets sent 233.46 million XRP to addresses controlled by the attackers, Binance said.
Outflows then spread across several networks. Binance reported unauthorized transfers of approximately 970,500 SOL from Solana hot wallets, 44.20 million OP from Optimism wallets, and 18,270 BTC from Bitcoin hot wallets. An internal alert for large transfers prompted an investigation as additional transactions emerged.
The final known unauthorized transfer was 2,961.9 ETH, Binance said. It was confirmed on Ethereum at 23:56 UTC, after being broadcast earlier and remaining pending in the network's transaction pool.
Binance paused withdrawals and contacted counterparties and blockchain-tracing partners to freeze assets. The company said those actions helped stop or intercept $2.85 billion, though the withdrawal pause could not immediately halt every transaction linked to the compromised Ethereum wallet.
EIP-7702 delegation complicated containment
The attackers used Ethereum's EIP-7702 authorization mechanism, Binance said, to delegate limited execution rights from a Binance hot wallet to a smart contract under their control. That delegation allowed the malicious contract to execute transactions without exposing the wallet's private keys or relying on the exchange's normal withdrawal infrastructure.
EIP-7702 is designed to let externally owned Ethereum accounts temporarily adopt smart-contract-like behavior through authorization. In this case, Binance said attackers submitted 50 signed transactions to manipulate account nonces — the sequence numbers that order a wallet's transactions — and establish a malicious delegation.
That structure extended the incident after Binance halted withdrawals. Once an authorization had been recorded on-chain, the delegated smart contract could continue executing within its permitted scope independently of the exchange's central withdrawal systems.
The affected wallet used multi-party computation, or MPC, according to Binance. MPC divides signing authority among multiple parties rather than storing one private key in a single location. While that model is intended to reduce the risks tied to a single compromised key, Binance said it meant there was no individual private key that could be immediately revoked to erase the on-chain delegation.
At 00:10 UTC on Oct. 30, Binance said it used the Binance14 hot wallet to issue a new authorization to Ethereum's zero address, clearing the EIP-7702 delegation code and ending that avenue of execution.
Fake job interviews led to endpoint compromise
Binance's account describes an intrusion path that began months before the transfers. In June, a wallet DevOps engineer downloaded a tampered Homebrew installer after searching for an AI coding tool, according to the company. Binance said it replaced the employee's device and rotated credentials after detecting anomalies.
A second compromise followed in September, when a software engineer was approached through a job platform by someone posing as a project director. The engineer's public profile referred to previous work at Binance, the company said.
The contact arranged a video interview involving someone presented as an HR representative, followed by a chat-based interview with a person claiming to be the chief executive of a fictitious company. Near the end of that exchange, Binance said, the engineer was asked to download a homework code repository onto a work computer.
Malicious code ran during the repository's setup process, Binance said. The company described malware that replaced legitimate developer-tool components, communicated with attacker-controlled servers and used concealment techniques, including log clearing. Binance said its endpoint security tools did not initially detect the malware because it functioned as a zero-day, meaning the relevant defensive tools had no existing signature or detection rule for it.
The company cited file changes involving the pyenv developer environment under the /opt/homebrew/ directory, including replacement of a legitimate executable and creation of a new symlink before a zsh shell was launched. Those changes gave the malware a way to blend into a familiar developer workflow.
Attackers moved through internal systems
On Oct. 20, attackers used the compromised machine to pivot through an internal AI tool and gain control of two additional computers, Binance said. One belonged to the wallet DevOps engineer associated with the June incident, while the other was used by a wallet software engineer.
Binance said the attackers found a container-deployment permission token on the wallet DevOps computer. Between 17:15 and 19:56 UTC on Oct. 29, they allegedly logged into the wallet software engineer's machine, deployed a container with stolen credentials and ran a malicious script that ultimately reached the wallet-signing environment.
The sequence places the breach in the overlap between software-development tooling and custody infrastructure. The attackers did not need to defeat wallet cryptography directly, according to Binance's description; they gained trusted access through employee endpoints and internal deployment permissions, then used valid-looking authorization flows to move assets.
Binance said it had detected and blocked 57 suspected DPRK-linked cyber threats during 2026 before the breach. The exchange is continuing to work with law enforcement, blockchain-intelligence firms and industry partners to trace the stolen assets and seek further freezes.
Binance rebuilds wallet environment and seeks outside review
As of Nov. 3, Binance said it had rebuilt affected wallet systems in a new environment, replaced compromised devices, disabled affected credentials and tokens, and rebuilt the internal AI tool with tighter access controls.
The exchange also said it expanded device scans, strengthened wallet-service controls and added more AI-assisted behavior monitoring. It plans to spend further on endpoint protection, development-environment security and anomaly detection.
Binance has invited an independent cybersecurity firm to review its findings and recommend additional safeguards. Some technical details have been withheld, the company said, to avoid giving potential copycat attackers a roadmap into the rebuilt systems.
Worried about exchange hacks? Learn key lessons from past incidents in what to learn from crypto security breaches.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
