Key Takeaways:
- Binance claimed that their $6.34 billion hack happened over a month-long attack campaign.
- Hackers’ applications included fake job interviews, malware and using compromised internal AI tooling.
- Around $2.85 billion in funds has been frozen, with 98% of affected tokens being topped up.
Binance has released its first detailed account of the October 29th breach, revealing that attackers spent months building access before reaching the exchange’s wallet-signing infrastructure.
https://t.co/sU9dUqLQDH
— Binance (@binance) November 3, 2026
Social engineering, endpoint compromise and the misuse of the Ethereum transaction authorization capabilities were all cited by the crypto exchange as causatives in the incident.
Read More: Binance $6.3B Hack Triggers FBI Probe While $3B in Stolen Crypto Gets Frozen
Binance Hack Started Months Before the $6.34B Theft
Binance says the hack started back in June, when a newly hired Wallet DevOps engineer downloaded a modified software package during the installation of an AI coding tool.
Binance noticed that incident and rotated credentials and replaced the device. But the attacker had already learned information about how the engineer worked on wallet infrastructure and its other team members. Walls was targeted again in September using a legitimate job-search website.
The attacker pretended to be a recruiter, followed by a video interview, and then requested the engineer’s attention to download a coding assignment. Malware in the repository was used to run during installation and write to the employee’s work computer.
Read More: Binance Restores 15 Networks After $6.3B Hack While Outflows Surge to $5.8B
Internal AI Tool Became Part of the Attack Path
The attackers were then able to use the impersonated device and AI tool to gain access into the systems of two other engineers, Binance said.
By October 20th, they found a token for container deployments in a Wallet DevOps employee’s possession. A stolen set of credentials was leveraged to launch a container and send malicious code into Binance’s wallet environment on October 29th.
The hackers subsequently accessed an internal wallet-signing service, thus circumventing the exchange’s typical withdrawal procedure.
Attackers Exploited EIP-7702 to Keep Moving Crypto
Several networks were vulnerable to the hack. The attacker has received 5 Binance hot wallets with a total of 233.46 million XRP. Other wallets made another 970,503 SOL and 44.2 million OP transfers, followed by 18,270 BTC transfers.
EIP-7702 is a feature in Ethereum that enables delegation of execution rights from an account to a smart contract, which the attackers exploited.
According to Binance, their research was able to detect a malicious nonce manipulation using 50 signing transactions. They were never removed after the withdrawals were paused and withdrawing was not an option to stop all transfers instantly.
Also, the Multi-Party Computation wallet setup made it more difficult since there was no single private key to take out the malicious authorizations at a speedy go.
Binance Freezes $2.85B and Replenishes 98% of Tokens
Around $6.34 billion in digital assets were affected, according to Binance co-CEO Richard Teng. According to the CEO, more than $2.85 billion has been frozen or intercepted with assistance from the law enforcement and the tokens’ issuers and blockchain intelligence companies.
On 29 October, Binance was the target of one of the most sophisticated attacks the digital asset industry has ever seen. ~$6.34B in assets were impacted. We take full responsibility and we’re making it right.
No user bears the loss. We set aside more than the full amount required. At this moment, 98% of impacted tokens had been replenished; we’re completing the remaining 2%. Withdrawals have broadly resumed.
This wasn’t one mistake or one breach – it was a months-long campaign. We’re publishing the full report because the lessons go far beyond Binance.
~$2.85B has already been frozen or intercepted with law enforcement, issuers and blockchain intelligence firms. The speed of coordination could not be matched in traditional finance.
— Richard Teng (@_RichardTeng) November 3, 2026
Binance has pledged to take the hit, not the buyers. By October 31st, token assets representing 98% had been renewed, and the remainder of less liquid assets were being bought in.
The exchange has since rebuilt wallet systems and internal AI tools impacted, replaced compromised devices, revoked credentials and added AI-based behavioural anomaly detection.
