USD 6.34 billion impacted: the weakest link was not the cryptography
On 29 October 2026, attackers drained Binance hot wallets across several blockchains. Digital assets worth roughly USD 6.34 billion were impacted, several times the Bybit hack of February 2025 (around USD 1.5 billion). According to the FBI, North Korea is behind the attack. Binance says the exchange itself, not its customers, bears the loss. On 3 November, Binance published an initial incident report. It shows an attack in two phases: months of groundwork through individual employees, then just under four hours of access to the wallets.
What's the news
1. Months of preparation
- June, a tampered installer: A wallet DevOps engineer used a search engine to download a tampered Homebrew installation while setting up an AI coding tool. Binance replaced the device, but the attackers now knew his role and team.
- September, a fake job interview: A second engineer was invited to two interviews through a legitimate job platform and asked to run an "assignment" on his work computer. The code silently swapped a developer tool for a malicious version; endpoint protection did not detect the previously unknown malware.
- 20 October, an internal AI tool as a springboard: Through an internal AI tool, the attackers took control of two wallet engineers' machines and found an access token for container deployments. On 29 October, they used it to launch the script that reached the signing service.
2. The attack on 29 October
- Access to the signing service: The attackers used an internal wallet signing service to trigger transactions outside the regular withdrawal process.
- Four minutes for XRP: Between 20:05 and 20:09 UTC, five hot wallets sent 233.46 million XRP to the attackers. Roughly 970,500 SOL, 44.2 million OP and 18,270 BTC followed.
- EIP-7702 as the lever: With 50 signed transactions, the attackers gave their own smart contract execution rights over an Ethereum hot wallet. That delegation lived on-chain and kept working after Binance had already halted withdrawals.
- MPC slowed the defence: The wallet was secured by multi-party computation, so there was no single key that could revoke the delegation immediately. The final debit of 2,961.9 ETH was confirmed at 23:56 UTC; the delegation was cleared at 00:10 UTC on 30 October.
3. Damage control
- Frozen: Around USD 2.85 billion has been frozen or intercepted.
- Replaced: By 31 October, Binance had replenished 98 % of the drained tokens, verifiable via its Proof of Reserves; the exchange is still buying the less liquid assets.
- Rebuilt: Affected systems were rebuilt, devices replaced and credentials revoked. Independent security firms are reviewing the incident.
Good to know
- People are the attack surface: In 2026 alone, Binance says it fended off 57 suspected North Korea-linked attempts: fake job interviews, tampered developer tools, fake video-conferencing apps. One hit was enough.
- AI tools widen the risk: Both the June entry point and the October spread ran through AI tools. Anyone giving developers such tools has to secure them like privileged access.
- On-chain rights outlive the emergency stop: EIP-7702 makes wallets more flexible, but it creates permissions that a withdrawal halt does not touch. For custodians, revoking such delegations belongs in every incident plan.
- Exchange risk remains counterparty risk: Customers bear no loss because of Binance's capital strength, not because of a guarantee. A balance on an exchange is a claim against the exchange; self-custody or regulated custodians spread that risk.
Sources: Binance, "29 October 2026 Binance Security Incident: Initial Findings and Response Update" (3 November 2026, initial report); FBI public service announcement attributing the attack to North Korea (31 October 2026). The investigation is ongoing; figures may change with reconciliation.
This article is for information purposes only and does not constitute investment advice or a solicitation to buy or sell securities.