October Binance Security Incident: Initial Findings and Response Update

Binance says attackers used a months-long, multi-stage campaign culminating in unauthorized access to an internal wallet-signing service on October 29, 2026. The company links the preparation to a June supply-chain compromise and September fake recruitment interviews that tricked an engineer into installing malware on a work computer. The attackers later used that compromised device, an internal AI tool, stolen credentials, and a deployment token to reach wallet operations. They moved XRP, SOL, OP, and BTC, then exploited Ethereum’s EIP-7702 mechanism to grant a malicious smart contract authority to move assets outside Binance’s regular withdrawal system. Binance reports that the FBI attributes the incident to North Korea.

About $6.34 billion in digital assets were affected; roughly $2.85 billion had been frozen or intercepted by the time of the update. Binance says it will absorb the loss, has reserved more than the amount needed to cover it, and had replenished 98% of affected token assets by October 31, with illiquid assets still being purchased. Containment was complicated by existing on-chain permissions and the wallet’s multi-party signing setup; the final unauthorized transfer settled late on October 29, and Binance revoked the malicious delegation shortly after midnight. The company says it rebuilt affected systems, replaced devices, revoked credentials, tightened wallet controls, and expanded anomaly detection. It is commissioning an independent review and plans further investment in AI security and industry research.