Binance releases preliminary investigation report: Hackers infiltrated the operations team as early as June, will hire cybersecurity firm for a comprehensive review.

November 3: Binance released a preliminary investigation report on the October 29, 2026 security incident, disclosing the specific sequence of events, attack methods, and subsequent response measures. The report shows that approximately $6.34 billion in digital assets were affected in this incident. As of the report's publication, about $2.85 billion in assets had been frozen or intercepted; the relevant data still requires further verification and may be affected by market price fluctuations. Binance stated that it will bear all financial losses caused by the stolen funds and will not pass the losses on to users. As of October 31, 98% of the affected token assets had been replenished, and the relevant assets can be verified through the Binance Proof of Reserves page; the remaining assets with lower liquidity are being purchased to make up the shortfall.

The investigation shows that this attack was not a single security vulnerability or a simple phishing incident, but a multi-stage attack that had been prepared over a long period. The attackers combined fake recruitment interviews, malware, abuse of internal AI tools, compromise of employee endpoint devices, and vulnerabilities in on-chain transaction authorization mechanisms to gradually gain unauthorized access to the wallet signing service. On October 29, the attackers used the internal wallet signing service to initiate abnormal transactions, transferring XRP, SOL, OP, BTC, and other assets out of Binance hot wallets, and used Ethereum's EIP-7702 authorization mechanism to grant a malicious smart contract partial execution permissions. Because the relevant on-chain authorizations were independent of Binance's regular withdrawal system, suspending withdrawals could not immediately stop the asset transfers. The final unauthorized ETH transfer was confirmed on-chain at 23:56 UTC on October 29, and Binance subsequently revoked the relevant malicious authorizations at 00:10 UTC on October 30.

Binance stated that it has rebuilt the affected wallet system and internal AI tools, replaced the relevant devices, revoked the credentials and access tokens of affected employees, and conducted comprehensive security scans of employee devices, while strengthening risk controls for wallet services and AI-based behavioral anomaly detection. The attack preparation phase can be traced back to June 2026, when attackers came into contact with the wallet development and operations team through a tampered Homebrew installation package; in September, the attackers lured another employee through a fake recruitment interview into downloading a malicious code repository, and in October used the infected devices and internal AI tools to further expand privileges. Binance said it is working with law enforcement agencies, blockchain intelligence companies, and industry partners to track and freeze the stolen assets, and will hire an independent cybersecurity firm to conduct a comprehensive review, while increasing investment in AI security and promoting the establishment of a security research fund and related industry cooperation projects. The latest information from the U.S. Federal Bureau of Investigation (FBI) shows that North Korea is responsible for this attack.