Binance, a leading cryptocurrency exchange, has announced that it has replenished 98% of the assets affected by a major security incident on October 29. The breach involved approximately $6.34 billion in digital assets. The company has taken steps to absorb the financial losses rather than pass them on to users, setting aside more than the amount needed to cover the incident.
According to Binance, as of October 31, the exchange had restored 98% of the affected token assets. Users can verify this information through Binance's Proof of Reserves page. The company is currently purchasing the remaining less liquid assets to complete the replenishment process. Authorities and industry partners have also frozen or intercepted approximately $2.85 billion in digital assets.
The investigation into the breach revealed that attackers gained unauthorized access to an internal wallet signing service. This allowed them to initiate transactions outside the normal withdrawal process. Between 20:05 and 20:09 UTC, five Binance hot wallets transferred 233.46 million XRP to an attacker-controlled address. Other wallets sent approximately 970,500 SOL and 44.2 million OP.
The attackers exploited Ethereum's EIP-7702 authorization mechanism to grant a malicious smart contract partial execution rights over a Binance hot wallet. They submitted 50 signing transactions to establish unauthorized permissions, allowing them to move assets independently of Binance's normal withdrawal infrastructure. Binance suspended withdrawals and worked with partners to freeze affected tokens.
However, the exchange noted that these measures could not automatically revoke existing on-chain authorizations. Its Multi-Party Computation wallet system required a specialized procedure to remove the malicious permissions. The final unauthorized transfer involved 2,961.9 ETH and finalized at 23:56 UTC. Binance executed a new authorization at 00:10 UTC on October 30 to clear the malicious delegation code.
The investigation traced the attack's preparation to several months earlier. In June, an engineer downloaded a tampered Homebrew installation while trying to install an AI coding tool. Although Binance detected the anomaly and replaced the device, the attackers had already gained exposure to the engineer's role and colleagues. In September, another engineer fell victim to a fake recruitment process involving video interviews and a malicious coding assignment.
Binance's security team detected and prevented 57 suspected North Korea-linked cyber threat cases throughout 2026. Following the incident, the exchange rebuilt affected wallet systems and its internal AI tool, replaced compromised devices, revoked related credentials, and strengthened wallet controls and AI-based threat detection. The investigation remains ongoing, with Binance saying it will continue sharing findings while keeping some technical details confidential.
Key points
- Binance absorbed financial losses from the security breach rather than passing them on to users.
- Authorities and industry partners froze or intercepted approximately $2.85 billion in digital assets.
- The FBI attributed the October 29 cyberattack on Binance to North Korea.
