Cryptocurrency exchange Binance disclosed details of a major cyberattack. Investigators found that the attackers gained access to the exchange’s cryptocurrency wallet management system through social engineering, malware, and the company’s internal AI tools.
Binance, the world’s largest cryptocurrency exchange by trading volume, published preliminary findings from its investigation into the cyberattack, which affected about $6.34 billion in digital assets. According to the report, the incident followed a multistage campaign that began several months before the attack. The hackers systematically compromised employees’ work devices, gained access to internal infrastructure, and used a transaction signing service to transfer assets without authorization.
The investigation found that the attackers first made contact with the company in June, when an employee from the Wallet DevOps team downloaded a modified version of Homebrew to install a popular AI coding tool. Binance’s security system detected an anomaly, prompting the company to replace the device and update the associated credentials. However, the attackers obtained information about the engineer’s role and colleagues working with the exchange’s wallet infrastructure.
The hackers then turned to social engineering. One of their main methods of infiltrating Binance’s infrastructure involved a fake recruitment process. In September 2026, an individual posing as a project manager contacted one of the company’s engineers. After an initial video interview with a supposed HR representative, the employee attended a second interview with someone impersonating the CEO of a fictitious company.
During the second interview, the engineer was asked to download a coding assignment in the form of a software repository onto a work computer. When the project was configured, malware executed, replacing the pyenv development tool and establishing a connection to an attacker-controlled server. The malware used sophisticated concealment and evasion techniques, preventing Binance’s security systems from detecting the infection when it occurred.
On October 20, the attackers used the previously compromised computer and Binance’s internal AI tool to gain control of 2 additional engineers’ devices. They discovered a token on one of the devices that granted permission to deploy containers.
Immediately before the hack, between 17:15 and 19:56 UTC on October 29, the attackers connected to an engineer’s computer, used stolen credentials to deploy a container, and executed a malicious script.
Why Binance Couldn’t Immediately Stop the Theft
After gaining unauthorized access to an internal transaction signing service, the attackers initiated transfers that bypassed the standard withdrawal process.
The following transactions were recorded during the attack:
- 233.46 million XRP was transferred from 5 Binance hot wallets within 4 minutes, between 20:05 and 20:09 UTC;
- About 970,500 SOL and 44.2 million OP were transferred from hot wallets on the Solana and Optimism networks;
- 18,270 BTC was transferred to an attacker-controlled address;
- 2,961.9 ETH was transferred in the final unauthorized transaction, confirmed at 23:56 UTC.
The attackers also exploited the EIP-7702 mechanism on Ethereum, which allows wallet control to be delegated to smart contracts. Through 50 transactions, they granted a smart contract under their control the ability to transfer assets from a Binance hot wallet, bypassing the standard withdrawal process.
As a result, suspending withdrawals didn’t completely stop unauthorized transactions. The permissions established on the blockchain remained active independently of the exchange’s standard cryptocurrency withdrawal infrastructure.
The use of Multi-Party Computation (MPC) technology to manage the hot wallet created an additional challenge. Because there was no single private key, the malicious authorizations couldn’t be immediately revoked. Binance’s security team had to develop a separate procedure to invalidate them.
The delegated permissions were finally reset at 00:10 UTC on October 30 by creating a new authorization from the Binance hot wallet to the zero address. No further thefts were recorded after the final unauthorized transfer was confirmed at 23:56 UTC.
How Binance Is Strengthening Infrastructure and User Security
According to Binance, about $2.85 billion of the $6.34 billion in digital assets affected by the attack was frozen or intercepted through cooperation with law enforcement agencies, analytics firms, and industry partners. This represents about 45% of the total.
The exchange said it would assume full financial responsibility for the hack. It has already set aside funds covering more than 100% of the amount needed to compensate for losses. As of October 31, 98% of the lost assets had been restored, as reflected in its Proof of Reserves system. The company continues to acquire the remaining assets, which have lower liquidity.
Binance implemented several measures to address the attack and strengthen infrastructure security, including:
- Completely rebuilding the affected cryptocurrency wallet infrastructure in a new environment;
- Restoring its internal AI tool and reviewing its access control mechanisms;
- Replacing compromised employee devices and revoking associated credentials and access tokens;
- Conducting additional security checks on all employee devices;
- Strengthening risk controls for wallet services and AI-powered behavioral anomaly detection systems.
The company also plans to engage independent security experts to conduct audits, increase investment in protecting AI tools and developer environments, establish a research fund, and launch joint initiatives with industry partners focused on AI security and blockchain infrastructure.
Binance Resumes Withdrawals as Capital Outflows Slow
The cryptocurrency exchange also began the second phase of restoring cryptocurrency withdrawals following the hack. As of November 3, transactions involving assets on Ethereum, Solana, BNB Smart Chain, and XRP Ledger were fully available. The exchange also restored withdrawals in several fiat currencies, including USD, AED, VND, PHP, and IDR.
Capital outflows from the platform began to slow as operations resumed. According to DefiLlama, Binance recorded $2.57 billion in net outflows on November 2, down 58% from the previous day, when users withdrew $6.1 billion from the exchange.
Binance representatives also warned users about scammers exploiting the situation by promoting fake offers to expedite withdrawals and obtain compensation. The exchange emphasized that withdrawals are being restored in phases following security checks and that paid services promising to accelerate the process are fraudulent.
On October 30, 2026, Binance suffered a major cyberattack that resulted in losses of about $6.36 billion. During the first 24 hours after the hack, users withdrew $6.33 billion from the cryptocurrency exchange.
