Markets · Security
Binance said about $6.34 billion in digital assets were affected, about $2.85 billion has been frozen or intercepted, and 98% of the impacted token assets had been replenished by Oct. 31. It said, citing the FBI, that North Korea was responsible.
The attack that Binance said affected about $6.34 billion in digital assets on Oct. 29 started, by its own account, months earlier with a tampered software download and a job interview that wasn't real, and the company said it will cover the loss itself. "Binance will absorb the financial impact of the stolen funds, not our users," the exchange wrote in initial findings posted on its official X account at 9:33 a.m. EST Tuesday [1].
That promise matters to anyone holding assets on Binance. Binance said it has "already set aside more than 100% of the funds required to cover the loss," and that as of Oct. 31, "98% of the impacted token assets have been replenished and are verifiable on our Proof of Reserves page" [1]. Withdrawals have been reopening in phases since, as Le Coin has reported.
Binance described the campaign as a chain, not a single break-in. "It was not a single isolated breach or a simple phishing incident," it said [1].
The first link came in June. An engineer on Binance's wallet operations team, searching online for a popular AI coding tool, downloaded "a tampered Homebrew installation," Binance said. Homebrew is a common program for installing software on Mac computers. Security staff caught the anomaly, replaced the device and changed the related passwords and keys, Binance said, but the engineer's role, and colleagues on the wallet team, had been exposed to the attacker [1].
The second link came in September. A different software engineer, whose profile on a legitimate job-hunting platform mentioned his Binance experience, was approached by someone posing as a project director. Binance said he went through two rounds of interviews, including a live video call in which the interviewer shared personal photos to build trust. Near the end of the second, he was told to download an "assignment," a code project, onto his work computer [1]. Running its setup quietly swapped a legitimate developer tool for a malicious copy. Binance said the "0-day malware," meaning malicious code no security product had seen before, "was not detected by the endpoint security protection tools at the time" [1].
On Oct. 20, the attacker used that computer and "used an internal AI tool to gain control over" the first engineer and a third wallet engineer, Binance said. The first engineer's computer held a permission token for deploying software containers [1].
On Oct. 29, the attacker logged onto the third engineer's computer, deployed a container and launched a script against an internal wallet signing service, the system that approves transactions [1]. Binance gave that preparation window as 17:15 to 19:56 without naming a time zone; those times are as Binance gave them.
From 4:05 to 4:09 p.m. EDT (20:05 to 20:09 UTC), five Binance hot wallets, the online wallets an exchange uses for day-to-day withdrawals, sent 233.46 million XRP to an attacker-controlled address, Binance said. Wallets on Solana and Optimism followed, then bitcoin [1].
| Asset | Amount sent (native units) |
|---|---|
| XRP | 233.46 million |
| SOL | about 970,500 |
| OP | 44.2 million |
| BTC | 18,270 |
| ETH (final transfer) | 2,961.9 |
Source: Binance, initial findings, Nov. 3, 2026 [1]. Amounts as Binance stated them; Binance gave no dollar value per asset.
The last stage used a feature of Ethereum itself. The attacker used the signing service to exploit EIP-7702, an Ethereum feature that lets a wallet hand some of its powers to a piece of code without giving up its key. That gave an attacker-controlled program "partial execution rights over a Binance hot wallet," Binance said. It took 50 signing transactions to set up [1].
Shutting off withdrawals did not stop it, because the permission lived on the blockchain, outside Binance's own systems. And the wallet used multi-party computation, which splits control of a wallet among several parties, so there was "no single private key" that could quickly cancel the permission. Binance said its team had to build a special procedure to do so [1].
The final transfer, 2,961.9 ETH, settled at 7:56 p.m. EDT. At 8:10 p.m. EDT (00:10 UTC Oct. 30), Binance said, it cleared the permission from the wallet [1]. Binance said its containment efforts froze about $2.85 billion. It also said the FBI's latest information "indicates that the Democratic People's Republic of Korea is responsible," and that it had detected and prevented 57 suspected North Korea-linked threat cases in 2026 [1].
This is Binance grading its own failure, and it says so. The company called the report initial, said the investigation "remains ongoing" and that findings "will be subject to further independent review," and said some technical details will stay confidential [1]. The figures are unaudited. Binance said its frozen-or-intercepted total of about $2.85 billion is "subject to reconciliation and market price volatility" [1]. The 98% figure refers to token assets replenished, not to money recovered from the attacker, and Binance said it is still buying "the outstanding, more illiquid assets" [1].
The weak points Binance names are ordinary ones: a download from a search result, a coding "assignment" from a fake job interview, an internal AI assistant with too much reach. The costliest step was the one its own controls couldn't reach. Once the permission was on the blockchain, turning off withdrawals didn't stop it, and its key-splitting setup made the permission slower to cancel. Binance's list of fixes includes rebuilding "the affected internal AI tool and access controls" [1]. Le Coin's earlier fiat withdrawal update covers how withdrawals have reopened since.
Holding the Corner.
Not financial advice.