Binance has completed the replacement of cryptocurrency assets affected by its October 29, 2026 security breach, committing more than $6.34 bn in company funds to cover losses from what blockchain investigators describe as the largest cryptocurrency theft on record.
The attack compromised Binance’s internal wallet-signing infrastructure, allowing hackers to transfer digital assets from several hot wallets across multiple blockchains. Investigators have linked the operation to TraderTraitor, a North Korean cybercrime group.
- Hackers exploited Binance’s wallet-signing service after compromising employee devices through fake recruitment interviews, malware and internal AI tools.
- Blockchain analytics firm Chainalysis attributed the $6.34 bn theft to North Korea’s TraderTraitor group, identifying connections to previously stolen cryptocurrency.
- Binance has covered affected assets using corporate funds, SAFU reserves and surplus futures insurance funds, while restoring withdrawals gradually.
Binance said approximately $2.85 bn in stolen assets had been frozen or intercepted as of November 3. The exchange subsequently completed the replenishment of affected token balances and published a new proof-of-reserves snapshot on November 12.
How hackers stole $6.34 bn from Binance on October 29
The attack began after criminals obtained unauthorized access to an internal service responsible for signing cryptocurrency transactions.
According to Binance’s November 3 investigation report, the attackers used that access to initiate transfers outside the exchange’s normal withdrawal process.
Between 20:05 and 20:09 UTC on October 29, five Binance hot wallets transferred 233.46 mn XRP to an attacker-controlled address.
Other compromised wallets transferred approximately 970,500 SOL and 44.2 mn OP. The attackers also moved 18,270 BTC from a Binance hot wallet.
The attackers gained access to Binance’s transaction-signing infrastructure, enabling unauthorized transfers without using the exchange’s standard withdrawal procedures.
On Ethereum, the hackers exploited the EIP-7702 authorization mechanism, which allows an account to delegate execution permissions to a smart contract without disclosing its private key.
The attackers submitted 50 signing transactions to manipulate account nonces and establish malicious authorizations. These permissions enabled an attacker-controlled smart contract to move assets independently of Binance’s normal wallet infrastructure.
Suspending customer withdrawals therefore did not immediately stop the theft.
Binance’s use of multiparty computation (MPC) wallets complicated efforts to revoke the authorizations because no single private key could immediately disable them.
The final unauthorized transfer of 2,961.9 ETH was confirmed on-chain at 23:56 UTC. Binance cleared the malicious EIP-7702 delegation at 00:10 UTC on October 30.
Fake job interviews and compromised AI tools enabled the attack
Binance’s investigation identified a coordinated intrusion campaign that began months before the theft.
In June 2026, a wallet infrastructure engineer downloaded a compromised Homebrew installation while attempting to install an AI coding tool. Binance detected the suspicious activity, replaced the device and rotated associated credentials.
A separate attack in September targeted another software engineer through a legitimate employment platform.
An individual posing as a company executive arranged interviews with the employee, including a video conversation with a supposed human resources representative.
During a subsequent interview, the employee was instructed to download a coding assignment onto a work computer.
The repository contained malware that executed during setup, replaced a legitimate development tool component and established communication with an attacker-controlled server.
The malicious coding assignment provided an entry point into Binance’s development environment. The attackers then used compromised internal AI tooling to reach employees responsible for wallet infrastructure.
On October 20, the attackers used the compromised device and an internal AI tool to access additional engineers’ environments.
They discovered a container deployment permission token belonging to a wallet DevOps engineer.
On October 29, the hackers used stolen credentials to deploy a container and execute the malicious script that initiated the transfers.
Binance said the malware used previously undetected techniques to evade endpoint security systems and conceal evidence of the compromise.
North Korean TraderTraitor group linked to Binance theft
Blockchain intelligence company Chainalysis attributed the attack to TraderTraitor, a North Korean cybercrime group associated with cryptocurrency theft.
Binance separately cited information released by the US Federal Bureau of Investigation identifying North Korea as responsible for the incident.
Chainalysis based its assessment partly on blockchain transactions connecting funds stolen from Binance with cryptocurrency taken in an earlier attack on Bitget.
Chainalysis identified stolen Binance assets mixed with funds from a previous North Korea-linked Bitget theft, strengthening its attribution to TraderTraitor.
Investigators also observed rapid attempts to convert stolen stablecoins into assets that cannot be frozen by centralized issuers.
The attackers transferred approximately $500 mn in stablecoins into a wallet used for conversions. Over nearly 20 minutes, they exchanged $325 mn for approximately $285 mn in ETH.
The remaining $175 mn in stablecoins was sent to intermediary wallets, apparently to move funds before issuers could freeze them. Stablecoin freezes began at approximately 5:14 p.m. Eastern Time on October 29.
Chainalysis also identified thousands of transactions consistent with automated laundering. Multiple addresses received exactly 1 TRX before additional assets arrived and were forwarded elsewhere.
The investigation remains ongoing, and the identities of individual participants have not been publicly established in the findings reviewed.
Binance replaces stolen assets and commits to restoring SAFU fund
Binance said it used three funding sources to replenish balances affected by the breach: a partial deployment of its Secure Asset Fund for Users (SAFU), assets from its Futures insurance fund above required risk-management levels, and its corporate treasury.
Replacement tokens were acquired through market purchases and over-the-counter transactions.
By October 31, the exchange had replenished 98% of the affected token assets. The remaining purchases involved less liquid cryptocurrencies.
Binance has now completed coverage of affected assets and committed to rebuilding SAFU to approximately $1 bn, maintaining the fund as an emergency user-protection reserve.
The company has not disclosed an updated recovery total beyond the approximately $2.85 bn reported as frozen or intercepted on November 3.
The amount committed to replenishment should not be confused with the final unrecovered loss, which may change depending on asset recovery, reconciliation and market prices.
Binance publishes proof of reserves for 198 tokens
Binance completed a new proof-of-reserves snapshot at 00:00 UTC on November 12, covering 198 digital assets.
The exchange said the accompanying zero-knowledge proof would require approximately 40-50 hours of computation before users could independently verify that their assets were backed at a minimum ratio of 1:1.
The latest reserve snapshot covers 198 tokens, with cryptographic verification intended to demonstrate that affected customer balances are fully backed.
Withdrawals are being restored in phases. Binance has not provided a definitive timetable for completing the reopening process.
A small number of affected tokens no longer supported by the exchange will be handled under its delisting procedures, with their holders covered.
Following the breach, Binance rebuilt affected wallet systems and internal AI tools, replaced compromised employee devices, revoked exposed credentials and strengthened transaction-signing controls.
The exchange has also introduced additional behavioral anomaly detection and engaged external cybersecurity specialists to review the attack and its response.
