Binance’s security team detected and stopped 57 suspected North Korea-linked cyber threats over the course of 2026. One campaign slipped through. In its initial findings report , published on November 3, the exchange reconstructed a six-month, multi-stage intrusion that began with a tampered software installer in June and ended with unauthorized wallet signing on October 29, moving approximately $6.34 billion in digital assets, the largest theft the cryptocurrency industry has recorded.
The report is the first time Binance has laid out the full attack path, and it carries an unusual admission of scope. “Our current investigation indicates that this was a sophisticated, multi-stage campaign,” the exchange wrote. “It was not a single isolated breach or a simple phishing incident.” As of October 31, 98% of the affected assets had been replenished, and Binance set aside more than 100% of the funds required to absorb the loss itself rather than passing it to users.
On 29 October 2026, Binance experienced a serious and highly sophisticated security incident. This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry.
— Binance (@binance) November 3, 2026
A Six-Month Campaign in Four Stages
The first intrusion predates the theft by months. In June 2026, an engineer on the wallet DevOps team downloaded a tampered Homebrew installer while trying to set up a popular AI coding tool he had located through a search engine. Binance’s security team caught the anomaly, replaced the device, and rotated the related credentials, but by then the attacker had learned the engineer’s role and the identities of his colleagues on the wallet infrastructure team.
The second stage came in September, and it is the detail that has drawn the most attention. A software engineer was contacted through a legitimate job-hunting platform by someone posing as a project director. The profile the engineer maintained referenced his experience at Binance, which made him a target. The fake director arranged a first-round interview with a purported human-resources representative and a second round with someone claiming to be the chief executive of a company that does not exist.
During the first interview, conducted over live video, the fake HR representative shared a social media account carrying personal photos and videos to build credibility. “This was more advanced and deceptive than previously seen social engineering approaches,” Binance wrote. Near the end of the second interview, held on a chat application, the engineer was told to download an “assignment” containing a malicious code repository onto his work computer. “The repository contained malicious code that executed during the setup process, initiating a series of unauthorized activities.”
The malware used obfuscation to swap a legitimate development component for a poisoned version, replacing a valid
pyenv
binary of 3,344 bytes with a malicious one of 3,414 bytes, a difference of 70 bytes that was enough to execute commands and open a channel to an attacker-controlled server. Binance said the zero-day malware was not detected by its endpoint protection tools at the time.
The third stage arrived on October 20. Using the compromised computer and an internal AI tool, the attacker gained control of two more engineers, one of whom held a container deployment permission token on his machine. That token was the bridge to the wallet signing service.
The Night of October 29, Minute by Minute
Between 17:15 and 19:56 UTC on October 29, the attacker logged onto the second engineer’s computer, used credentials stolen earlier, deployed a container, and ran a malicious script. The actual movement of funds began minutes later. Between 20:05 and 20:09 UTC, five Binance hot wallets sent 233.46 million XRP to an attacker-controlled address, and hot wallets on Solana and Optimism sent roughly 970,500 SOL and 44.2 million OP. A separate hot wallet then moved 18,270 BTC.
Binance received an internal alert on the large transfers and began investigating immediately, the same containment sequence it described when it first disclosed the breach on October 30 . The exchange suspended withdrawals and coordinated with partners to freeze funds, a step that ultimately froze $2.85 billion. The final unauthorized transfer of 2,961.9 ETH finalized on-chain at 23:56 UTC, and at 00:10 UTC on October 30 the exchange cleared the delegation code from its Binance14 hot wallet.
Why EIP-7702 Made the Breach Harder to Stop
What set this incident apart from a conventional hot-wallet drain was the mechanism the attacker used to keep moving funds after withdrawals were suspended. The attacker exploited Ethereum’s EIP-7702 authorization feature, which lets an account delegate execution rights to a smart contract without exposing its private key. That allowed an attacker-controlled contract to hold partial execution rights over a Binance hot wallet, and the attacker submitted 50 signing transactions to manipulate the account nonce and lock in those authorizations.
“The malicious EIP-7702 authorizations existed on-chain and operated independently of Binance’s normal withdrawal infrastructure,” the exchange wrote. Because the hot wallet used multi-party computation, there was no single private key that could simply be revoked. Binance had to develop and run a specialized procedure to revoke the on-chain authorizations, which extended the time needed to fully contain the movement of funds. That is the structural explanation for the roughly three-hour gap between the first XRP transfer at 20:05 UTC and the final ETH transfer at 23:56 UTC.
The 57 Threats That Were Stopped
The most telling counterpoint in the report is what did not happen. Throughout 2026, Binance’s security team detected and prevented 57 suspected North Korea-linked cyber threat cases before they could reach a wallet. “These attempts reflect the persistent threat posed by state-sponsored actors targeting the cryptocurrency industry,” the exchange wrote. The techniques it catalogued include fraudulent job interviews, malware disguised as popular developer tools, compromised software packages and browser extensions, fake video conferencing applications, and social engineering campaigns designed to steal credentials or deploy remote access malware.
The Federal Bureau of Investigation has separately attributed the October 29 incident to the Democratic People’s Republic of Korea, a finding Binance cites in its report. That attribution is consistent with the pattern Binance describes, though the exchange’s own wording keeps the campaign’s authorship at the level of “suspected” threats while the investigation continues.
What the Initial Report Leaves Unanswered
Binance is explicit that this is a first account, not a final one. The full financial picture is still settling: approximately $2.85 billion has been frozen or intercepted out of roughly $6.34 billion affected, leaving about 45% of the affected value recovered or restricted so far, subject to reconciliation and market price movement. The 98% replenishment figure works out to roughly $6.21 billion already restored on the exchange’s own books, with the remaining balance tied up in less liquid assets the exchange says it is still purchasing.
Several questions remain open. The exchange has not named the job-hunting platform, the fictitious company, or the internal AI tool, and it says some technical details will stay confidential to prevent copycat attacks. It is engaging independent third-party security firms to review its findings, and it has committed to a security research fund focused on AI security in blockchain environments. “We are sharing this initial report because security improves when the industry learns together,” Binance wrote, while leaving the independent review as the next checkpoint for whether that account holds.
