KEY POINTS
- Binance says approximately $6.34 billion in digital assets were affected by a security incident on October 29.
- The cryptocurrency exchange says $2.85 billion has been frozen or intercepted.
- Binance reported that 98 per cent of affected token assets had been replenished as of October 31.
- The company says the FBI has identified North Korea as responsible for the attack.
MAIN STORY
Cryptocurrency exchange Binance has disclosed that approximately $6.34 billion in digital assets were affected by a sophisticated security breach on October 29, with $2.85 billion frozen or intercepted following its response to the incident.
The company disclosed this in a statement published on its X page on November 3, titled 29 October Binance Security Incident: Initial Findings and Response Update.
According to Binance, the attack involved unauthorised access to an internal wallet signing service, which allowed attackers to initiate transactions outside the platform’s normal withdrawal process.
The company said that as of October 31, it had replenished 98 per cent of the affected token assets, with the restored holdings verifiable through its Proof of Reserves page. It added that it had set aside more than 100 per cent of the funds required to cover the loss and would bear the financial impact rather than pass it on to users.
Binance said it was still purchasing the outstanding, less liquid assets, while the reported $2.85 billion in frozen or intercepted funds remained subject to reconciliation and market price volatility.
The exchange explained that the attackers moved assets across several blockchain networks, including XRP, Solana, Optimism, Bitcoin and Ethereum.
Between 20:05 UTC and 20:09 UTC on October 29, five Binance hot wallets transferred 233.46 million XRP to an address controlled by the attackers. Other transactions involved approximately 970,500 SOL and 44.2 million OP, followed by a transfer of 18,270 BTC.
Binance said its internal systems subsequently raised an alert over large-volume transfers, prompting an investigation and containment measures.
The attackers also exploited Ethereum’s EIP-7702 authorisation mechanism to give a malicious smart contract partial execution rights over a Binance hot wallet. This allowed them to continue moving assets independently of the exchange’s normal withdrawal infrastructure.
The company said suspending withdrawals and shutting down hot wallet services could not automatically cancel the unauthorised permissions already established on the blockchain.
It added that the use of Multi-Party Computation (MPC) in the affected wallet created additional technical challenges because there was no single private key that could immediately revoke the malicious authorisations.
Binance said the final unauthorised transfer, involving 2,961.9 ETH, was finalised on-chain at 23:56 UTC. It executed a new authorisation at 00:10 UTC on October 30 to clear the malicious delegation code.
THE ISSUES
Binance’s account suggests the breach extended beyond a direct attack on its cryptocurrency wallets. The company described a multi-stage campaign involving social engineering, malicious software, compromised internal tools and unauthorised access to systems used in wallet operations.
Its investigation traced part of the preparation to June 2026, when an engineer downloaded a tampered Homebrew installation while trying to install an AI coding tool. Binance said its security team detected the anomaly, replaced the device and rotated related credentials, but the engineer’s role and those of colleagues working on wallet infrastructure had already been exposed.
The company also described a September incident in which another engineer was approached through a job-hunting platform by individuals posing as recruiters. After conducting video interviews, the supposed recruiters instructed the engineer to download an assignment containing malicious code onto a work computer.
Binance said the malware enabled unauthorised activities and helped attackers gain access to internal systems. On October 20, the attackers allegedly used a compromised computer and an internal AI tool to gain access to other employees and obtain a deployment permission token.
By October 29, the attackers had used stolen credentials to access wallet signing operations and execute the transfers.
The company said its security team had detected and prevented 57 suspected North Korea-linked cyber threat cases throughout 2026, reflecting what it described as a persistent threat from state-sponsored actors targeting the cryptocurrency industry.
WHAT’S BEING SAID
“This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry.” – Binance, statement published November 3.
“Our first responsibility is to protect users. Binance will absorb the financial impact of the stolen funds, not our users.” – Binance, statement published November 3.
“The latest information released by the Federal Bureau of Investigation indicates that the Democratic People’s Republic of Korea is responsible for this incident.” – Binance, statement published November 3.
WHAT’S NEXT
Binance said it had rebuilt the affected wallet system in a new environment, rebuilt its internal AI tool and access controls, replaced affected devices and decommissioned credentials and tokens linked to the engineers involved.
It also reported completing enhanced security scans across employee devices, strengthening wallet-service risk controls and expanding AI-based behavioural anomaly detection.
The exchange said it was working with law enforcement agencies, blockchain intelligence firms and industry partners to trace and freeze affected assets.
It is also engaging independent cybersecurity experts to review the incident, validate its findings and recommend additional security measures.
Other planned actions include increased investment in AI-enabled detection, endpoint protection and developer-environment security, as well as the establishment of a security research fund focused on AI security in blockchain environments.
Binance said its investigation remained ongoing and that some technical details would not be made public to prevent attackers from using the information to plan further attacks.
BOTTOM LINE
Binance says it has replenished most of the assets affected by the October 29 breach and taken steps to strengthen its security systems. However, the incident exposed weaknesses in internal access controls and wallet authorisation processes, highlighting the security risks facing cryptocurrency platforms as attackers exploit both human vulnerabilities and technical systems.
