Binance has released initial findings into the October 29 security incident that affected approximately $6.34 billion in digital assets, outlining a multi-stage attack that involved social engineering, compromised devices, internal systems and stolen credentials before attackers gained unauthorized access to an internal wallet-signing service.
The cryptocurrency exchange said the investigation remains ongoing, but its findings provide the clearest account so far of how the attack developed over several months and culminated in unauthorized transfers across multiple blockchain networks.
Binance said it would absorb the financial impact rather than pass losses on to users and had set aside more than 100 percent of the funds required to cover affected assets.
As of October 31, 98 percent of impacted token assets had been replenished and were verifiable through its Proof of Reserves, while Binance continued purchasing the remaining less-liquid assets.
Approximately $2.85 billion of affected assets had also been frozen or intercepted, although Binance said the final amount remains subject to reconciliation and changes in market prices.
Attack developed gradually
Binance said its investigation identified activity preceding the October 29 incident rather than a single isolated compromise.
The company reported a supply-chain security incident in June 2026, followed by social engineering activity targeting an engineer in September.
On October 20, Binance said the attacker used a compromised computer and an internal AI tool to reach additional employees, extending access within the organization.
The attack escalated on October 29, when stolen credentials were allegedly used to deploy a container and trigger unauthorized activity involving Binance’s internal wallet-signing infrastructure.
Binance described the incident as a multi-stage campaign involving social engineering, malicious downloads, compromised internal AI tooling, endpoint compromise and techniques targeting transaction authorization.
The findings shift the focus beyond the compromise of an individual device. According to Binance’s account, the attacker moved through several layers of its internal environment before gaining the access necessary to initiate transactions from hot wallets.
The internal wallet-signing service became a critical part of the attack because it forms part of the infrastructure used to authorize cryptocurrency transactions.
Once unauthorized access had been obtained, the attacker began moving assets across several blockchain networks.
Read more: Bitcoin falls to $77,657 as U.S. election uncertainty weighs on crypto
Hot wallets targeted
Between 20:05 UTC and 20:09 UTC on October 29, five Binance hot wallets transferred 233.46 million XRP to an attacker-controlled address, according to the company’s findings.
Other hot wallets transferred approximately 970,500 SOL, 44.2 million OP and 18,270 BTC.
The attacker later targeted Binance’s Ethereum infrastructure using a different mechanism.
Binance said the attacker exploited Ethereum’s EIP-7702 authorization mechanism to grant a malicious smart contract partial execution rights over one of the exchange’s hot wallets.
EIP-7702 allows externally owned Ethereum accounts to temporarily delegate execution capabilities to smart-contract code. In this case, Binance said an unauthorized delegation allowed malicious code to execute transactions involving the affected wallet.
The final unauthorized transaction involved 2,961.9 ETH and was finalized on-chain at 23:56 UTC.
At 00:10 UTC on October 30, Binance cleared the delegation code using a new authorization.
The exchange said no further unauthorized transfers were observed after the final transaction.
That sequence also complicated the containment process because some permissions already recorded on-chain could continue operating independently of Binance’s conventional withdrawal systems.
Suspending withdrawals therefore prevented additional activity through normal exchange channels but did not automatically revoke every blockchain-level authorization created during the attack.
Authorizations complicated response
Binance said the affected hot wallet used multi-party computation, adding another layer of complexity to the response.
Because existing on-chain authorizations could continue executing independently, the security team had to develop a specialized process to remove them safely.
The company said suspending withdrawals, revoking permissions and working with token issuers and other industry partners to freeze assets helped contain the incident.
Binance subsequently closed the attack entry points identified during the investigation and rebuilt or replaced affected systems.
The exchange also tightened device-management controls, strengthened risk controls around wallet services and expanded the use of AI-based anomaly detection.
As of November 3, Binance said it had rebuilt the affected systems and the internal AI tool involved in the compromise, replaced relevant devices and revoked associated credentials and tokens.
Employee devices were also scanned as part of a broader review aimed at identifying any additional compromise.
The findings highlight how an attack on a cryptocurrency exchange can extend beyond cryptocurrency wallets themselves and involve employee endpoints, software infrastructure, authorization mechanisms and the internal tools surrounding transaction execution.
They also show why simply suspending withdrawals may not be sufficient when attackers have already established blockchain-level permissions.
Recovery runs alongside probe
Alongside the technical investigation, Binance has continued replacing affected assets and tracing stolen funds.
The company said more than enough capital had been reserved to cover the approximately $6.34 billion impact and that users would not be required to absorb the losses.
By October 31, 98 percent of affected token assets had been replenished, with the remaining portion consisting mainly of less-liquid cryptocurrencies that Binance was sourcing through the market.
Separately, around $2.85 billion had been frozen or intercepted with assistance from token issuers, blockchain intelligence firms and other partners.
The two figures represent different aspects of the response. Replenishment refers to Binance replacing assets using its own resources, while frozen or intercepted funds relate to efforts to stop the attacker from moving stolen cryptocurrency.
Binance said it continues to cooperate with law enforcement agencies, blockchain intelligence companies and industry participants as the investigation progresses.
The company also cited the FBI’s latest information attributing responsibility for the attack to the Democratic People’s Republic of Korea. Binance’s own technical investigation, however, remains ongoing.
Independent cybersecurity specialists are expected to review the findings.
Binance also plans to increase investment in AI-enabled security, develop a security research fund and work on broader industry initiatives intended to strengthen defenses against similar attacks.
