Binance has published its initial post-mortem of the October 29 security breach that resulted in approximately $6.34 billion in stolen digital assets across multiple blockchains.
The report reveals how attackers combined social engineering, malicious software, compromised employee devices, and an internal artificial intelligence tool to gain unauthorized access to the exchange's wallet-signing infrastructure.
The operation began months before the actual theft, with attackers targeting employees through fraudulent recruitment campaigns and compromised developer tools. Binance acknowledged that the incident should never have happened and apologized for the disruption it caused users and industry partners.
However, the exchange reiterated its commitment to cover all losses, confirming that it had replenished 98% of affected token assets as of October 31, with the remaining, less liquid assets still being acquired. Binance also reported that approximately $2.85 billion in assets had been frozen or intercepted.
How Attackers Compromised Binance Employees
According to the report, the attackers began their preparation in June 2026 by targeting a Wallet DevOps engineer through a tampered Homebrew installation.
The engineer downloaded the compromised package manager software while attempting to install an AI coding tool. Binance detected the anomaly, replaced the affected device, and rotated related credentials. However, the attackers had already obtained information about the engineer's role and colleagues.
In September, the attackers targeted another software engineer through a fraudulent recruitment process. They posed as representatives of a fictitious company, conducted virtual interviews, and eventually instructed the employee to download a coding assignment onto his work computer.
The repository contained malicious code that replaced a legitimate development tool component with a malicious version. The malware established communication with an attacker-controlled server and used evasion techniques to avoid endpoint security detection.
On October 20, attackers used the compromised computer and an internal AI tool to gain control over the devices of 2 additional wallet engineers, including the engineer whose computer contained container deployment credentials. On October 29, they used the stolen credentials to deploy a container and execute a malicious script that initiated the wallet attack.
EIP-7702 and MPC Complicated the Response
The attackers exploited Ethereum's EIP-7702 authorization mechanism to gain execution privileges over a Binance hot wallet without obtaining its private key. They submitted 50 signing transactions to manipulate the account nonce and establish malicious delegation authorizations. These permissions allowed the attacker to move funds independently of Binance's regular withdrawal infrastructure.
This created an additional challenge when Binance suspended withdrawals. Shutting down the withdrawal service did not automatically invalidate existing onchain authorizations. Binance's Multi-Party Computation (MPC) wallet architecture also complicated the revocation process because no single private key existed to immediately remove the malicious permissions.
The team developed a specialized procedure to revoke the authorizations. The final unauthorized transfer, involving 2,961.9 ETH, settled at 23:56 UTC on October 29. Binance cleared the malicious EIP-7702 delegation at 00:10 UTC on October 30.
Binance Strengthens Security After Over 57 Attacks in 2026
Binance says it has rebuilt the affected wallet system and internal AI tool, replaced compromised devices, revoked affected credentials, and completed enhanced security scans across employee devices. The exchange has also strengthened wallet-service risk controls and expanded AI-based behavioral anomaly detection.
Notably, Binance revealed that its security team detected and prevented 57 suspected North Korea-linked cyber threat cases throughout 2026. These included fraudulent recruitment campaigns, malicious developer tools, compromised software packages, browser extensions, and fake video conferencing applications.
The FBI officially attributed the October 29 attack to North Korea's TraderTraitor group. North Korea rejected the allegation, with Kim Yo Jong, sister of North Korean leader Kim Jong Un, describing the attribution as a political provocation.
Binance is engaging independent cybersecurity firms to review the incident and validate its findings. It also plans to establish a security research fund and collaborate with AI companies and security firms on initiatives targeting AI-related threats in blockchain environments.
Is AI The Biggest Threat To Crypto?
The incident has renewed concerns about how artificial intelligence could change cybersecurity threats, particularly as attackers exploit internal tools and trusted employee access. Speaking during a livestream, Binance co-founder Changpeng Zhao argued that financial institutions must rethink security mechanisms designed before AI's rapid advancement. He said, “Going forward with AI advancing so quickly, there's so much work to be done, and I think the crypto industry as a whole, I would say probably the global financial industry as well, to improve security mechanisms that were designed in the pre-AI age versus now as we're kind of entering the post-AI age.” He also expressed optimism that AI would eventually improve security, although the industry currently faces a period of adjustment as new vulnerabilities emerge.
Solana co-founder Anatoly Yakovenko disagreed with the sentiment in a Tuesday post, saying, “Phishing and social engineering is the biggest threat to crypto. Not AI breaking math or quantum computers.”
Binance’s post-mortem itself reveals how traditional social engineering techniques can become significantly more dangerous when combined with new AI tools. The exchange has resumed normal operations while investigations continue.
Read More on SolanaFloor
Kamino CEO Michael Weisz Outlines Vision for $KMNO Token
Solana Tokenization Roundup: October 2026
$6.3B Drained From Binance. Why No Crash?
