Binance on November 3 released its first detailed account of the October 29 breach that affected approximately $6.34 billion in digital assets, revealing that the attackers spent months building access before reaching the exchange's wallet-signing infrastructure. The crypto exchange cited social engineering, endpoint compromise, and the misuse of Ethereum's transaction authorization capabilities as the causes of the incident.

The company said the operation combined fake job interviews, malware, and the compromise of internal AI tooling. Around $2.85 billion in funds has since been frozen or intercepted, 98% of the affected tokens have been replenished, and withdrawals have broadly resumed, according to Binance.

— Binance (@binance) November 3, 2026

In the report, Binance said it was publishing the full account because the lessons from the incident extend beyond the exchange itself. The account is notable for the path it describes: access to the wallet-signing system was built through staff endpoints, hiring workflows, and internal tooling rather than a direct hit on the wallets themselves — a sequence Binance framed as relevant to the wider industry.

Attack Began Months Before the $6.34 Billion Theft

According to Binance, the intrusion began in June, when a newly hired Wallet DevOps engineer downloaded a modified software package during the installation of an AI coding tool. The exchange detected that incident, rotated credentials, and replaced the device, but the attacker had already learned information about how the engineer worked on wallet infrastructure and about other members of the team.

The engineer was targeted again in September through a legitimate job-search website. The attacker posed as a recruiter, moved the process to a video interview, and then asked the engineer to download a coding assignment. According to Binance, malware embedded in the repository ran during installation and wrote to the employee's work computer.

Internal AI Tool Became Part of the Attack Path

Binance said the attackers then used the impersonated device and the AI tool to gain access to the systems of two other engineers. By October 20, they had located a token for container deployments in a Wallet DevOps employee's possession. Using the stolen set of credentials, the attackers launched a container and sent malicious code into Binance's wallet environment on October 29.

The hackers subsequently accessed an internal wallet-signing service, circumventing the exchange's typical withdrawal procedure.

Attackers Exploited EIP-7702 to Keep Moving Crypto

Several networks were affected by the breach. According to the report, the attacker drained five Binance hot wallets — the internet-connected wallets exchanges use for day-to-day transfers — holding a combined total of 233.46 million XRP. Additional transfers moved 970,503 SOL and 44.2 million OP, followed by transfers of 18,270 BTC.

EIP-7702 is a feature of Ethereum that enables the delegation of execution rights from an account to a smart contract, and Binance said the attackers exploited it. The company's investigation detected malicious nonce manipulation — tampering with the sequence numbers Ethereum uses to order transactions from an account — across 50 signing transactions.

According to the report, the malicious authorizations were not removed after withdrawals were paused, because pausing withdrawals was not an option that could stop all transfers instantly. The Multi-Party Computation wallet setup further complicated the response, since there was no single private key that could be used to revoke the malicious authorizations quickly.

Binance Freezes $2.85 Billion and Replenishes 98% of Tokens

Approximately $6.34 billion in digital assets were affected, according to Binance co-CEO Richard Teng. More than $2.85 billion has been frozen or intercepted with assistance from law enforcement, token issuers, and blockchain intelligence companies, according to the executive.

On 29 October, Binance was the target of one of the most sophisticated attacks the digital asset industry has ever seen. ~$6.34B in assets were impacted. We take full responsibility and we're making it right. No user bears the loss. We set aside more than the full amount required. At this moment, 98% of impacted tokens had been replenished; we're completing the remaining 2%. Withdrawals have broadly resumed. This wasn't one mistake or one breach – it was a months-long campaign. We're publishing the full report because the lessons go far beyond Binance. ~$2.85B has already been frozen or intercepted with law enforcement, issuers and blockchain intelligence firms. The speed of coordination could not be matched in traditional finance.

— Richard Teng (@_RichardTeng) November 3, 2026

Binance has pledged to absorb the losses from the incident rather than passing them on to users. By October 31, token assets representing 98% of the impacted holdings had been renewed, while the remaining, less liquid assets were in the process of being purchased.

The exchange has since rebuilt the wallet systems and internal AI tools affected by the incident, replaced compromised devices, revoked credentials, and added AI-based behavioral anomaly detection. Still outstanding, per Binance's timeline: the final 2% of token replenishment, the purchase of the remaining less liquid assets, and continued recovery work with law enforcement, token issuers, and blockchain intelligence firms on funds not yet frozen or intercepted.

Source: CryptoNinjas