Binance's initial hack findings: a fake job interview and an internal AI tool led attackers to its wallet signing service

Binance's first report on what went wrong

Binance has published its first detailed account of the security incident that hit the exchange on 29 October 2026. In an article posted on its official X account at 14:33 UTC on Tuesday 3 November (15:33 in Amsterdam), titled "29 October Binance Security Incident: Initial Findings and Response Update", the company apologised and said the attack should not have happened.

Binance puts the impact at approximately USD 6.34 billion in digital assets. Approximately USD 2.85 billion has been frozen or intercepted so far, a figure it says is subject to reconciliation and market price volatility. It repeats that it will absorb the financial impact, not its users, says it has set aside more than 100% of the funds required to cover the loss, and says that as of 31 October 98% of the impacted token assets had been replenished and are verifiable on its Proof of Reserves page. It is still buying the outstanding, more illiquid assets.

Binance also writes that the latest information released by the US Federal Bureau of Investigation (FBI) indicates that North Korea is responsible. The company stresses that this is an initial report, that the investigation is ongoing and that some technical details will stay confidential so they cannot be reused by other attackers.

How the attack was prepared

According to Binance, this was not a single phishing email but a multi-stage campaign. In June 2026 an engineer on its wallet DevOps team searched for a popular AI coding tool and downloaded a tampered installation of Homebrew, a common Mac package manager. Binance detected the anomaly, replaced the device and rotated credentials, but says the engineer's role and his colleagues had been exposed to the attackers.

In September a second engineer was contacted on a legitimate job platform by someone posing as a project director. After a video interview with a supposed HR representative and a second interview with a fake CEO in a chat app, he was told to download an "assignment" onto his work computer. The code repository contained malware that ran during setup and swapped a legitimate development tool for a malicious version. Binance says this 0-day malware was not detected by its endpoint protection tools at the time.

On 20 October the attacker used that compromised computer and an internal AI tool to gain control over two more wallet engineers, one of whom had a container deployment permission token on his computer. On 29 October between 17:15 and 19:56 the attacker logged onto one engineer's computer, used credentials stolen from the other, deployed a container and triggered the script that launched the attack. Binance adds that its security team detected and prevented 57 suspected North Korea-linked cyber threat cases during 2026.

What happened on 29 October

The attacker used unauthorised access to an internal wallet signing service to start transactions outside the normal withdrawal process. Between 20:05 and 20:09 UTC, five Binance hot wallets sent 233.46 million XRP to the attacker. Hot wallets on Solana and Optimism sent about 970,500 SOL and 44.2 million OP, and after an internal alert a Binance hot wallet also sent 18,270 BTC.

The attacker then abused EIP-7702, an Ethereum feature that lets an account delegate some execution rights to a smart contract. With 50 signing transactions the attacker gave its own contract partial control over a Binance hot wallet. Binance suspended withdrawals and worked with partners to freeze tokens, but those on-chain authorisations kept working independently of its withdrawal system. Because the hot wallet used multi-party computation (MPC), there was no single private key to cancel them immediately, so the team had to build a special revocation procedure.

The last unauthorised transfer, 2,961.9 ETH, finalised at 23:56 UTC on 29 October, and Binance says no further unauthorised transfers were seen. At 00:10 UTC on 30 October it cleared the EIP-7702 delegation on the affected hot wallet.

What Binance has changed and what comes next

As of 3 November, Binance says it has rebuilt the affected wallet system in a new environment, rebuilt the internal AI tool and its access controls, replaced affected devices, decommissioned credentials and tokens linked to the affected engineers and completed enhanced security scans of all employee devices. It has also strengthened wallet-service risk controls, expanded AI-based behavioural anomaly detection and worked with law enforcement, blockchain intelligence firms and partners to trace and freeze assets.

Next, it is engaging independent third-party cybersecurity experts to review the incident and validate its findings, increasing investment in AI-enabled detection and developer-environment security, and working on a security research fund with AI companies and security firms. For ordinary users the practical lesson matches Binance's own story: be wary of unsolicited job offers that ask you to run code, and install developer tools only from their official sites. Exchange.news will keep reporting Binance's official updates.