Written by: Sam, Techub News

Introduction

Five days after the Binance hot wallet theft incident on October 30, Binance released a preliminary investigation report on the evening of November 3. This is the first time Binance has fully disclosed the attack chain: the attacker took nearly five months, initially using a tampered Homebrew installer, a deceptive job interview, and internal AI tools, to gradually gain access to the computers of three engineers. Finally, early on October 30, access to wallet signature services was obtained, and using the Ethereum EIP-7702 authorization mechanism, assets continued to be transferred after withdrawal was suspended.

The report begins with the statement: "This should not have happened." Binance stated that the incident involved approximately $6.34 billion in assets, about $2.85 billion has been frozen or intercepted, and Binance will bear all losses. As of October 31, 98% of the affected tokens have been compensated. Following the report's release, industry insiders compared it to Huobi's security standards from years past, stating that Binance was "a bit too hastily put together"; Huobi co-founder Du Jun subsequently responded that customer asset security should not be a competitive point between exchanges and called for the establishment of a cross-platform security alliance.

Key Summary

• The preliminary investigation report by Binance stated that the incident involved approximately $6.34 billion in digital assets, with about $2.85 billion frozen or intercepted. Binance will bear all losses, and as of October 31, 98% of the affected token assets have been compensated, with the purchase of remaining low liquidity assets ongoing.
• The Binance report described this as a multi-stage attack wherein the attackers used deceptive job interviews, malware, internal AI tool intrusions, endpoint device compromises, and transaction authorization techniques, rather than a single point of intrusion or simple phishing; the FBI has attributed the incident to North Korea.
• The Binance report revealed that the attackers were able to transfer assets even after withdrawals were suspended because the malicious EIP-7702 authorization had already existed on-chain, independent of Binance's withdrawal system; the affected hot wallets utilized MPC technology, and there was no single private key that could be immediately revoked. The last unauthorized transfer was confirmed at 07:56, and Binance only cleared the delegated code at 08:10.
• Binance stated that all intrusion points have been blocked, the affected wallet system has been rebuilt in a new environment, and will invite independent cybersecurity companies for review, increase AI security investments, and prepare to establish a security research fund.
• Du Jun stated that no institution can achieve absolute security and that customer asset security should be the industry's common baseline. He hopes to establish a cross-platform security alliance to collaborate on threat intelligence sharing, risk warnings, emergency responses, and tracking stolen assets.

1. Five Months of Infiltration: From Tampered Homebrew to Internal AI Tools

Binance's report breaks down the preparation for the attack into four stages.

The first stage was a supply chain attack in June 2026. Engineer A from the wallet development and operations team, in order to install a popular AI programming tool, found and downloaded a tampered Homebrew installer through a search engine. Binance's security team detected anomalies at the time and replaced devices and rotated all related credentials, but Engineer A's job information, as well as that of his colleagues in the wallet infrastructure team, was already exposed to the attackers. The report includes a link to an analysis from SANS Internet Storm Center dated May 1, which documented a case where fake search ads impersonated a Homebrew page, coaxing users to run scripts in terminals that implanted the MacSync stealing trojan. Source: SANS ISC

The second stage was a social engineering attack in September, the most misleading part of the entire attack chain. Software Engineer B received a contact from someone claiming to be the "Project Director" on a legitimate job platform, initiating from B listing his experience at Binance in his personal profile. The other party arranged for a first-round real-time video interview with a "human resources representative" to establish trust, and the interviewer even shared his social media account with B, which contained personal life photos and videos; the second round of the interview took place on a popular social chat application, where the interviewer claimed to be the CEO of the fictitious company. Towards the end of the interview, B was asked to download a "homework" including a code repository onto his work computer, with malicious code executing during the installation process.

Binance stated that this piece of malware employed complex obfuscation and evasion techniques, and at the time, endpoint security tools failed to recognize this zero-day malware. Operations listed in the report show that it deleted the normal pyenv file from the Homebrew directory, replacing it with a 3,414-byte malicious version, reconstructing the symbolic link and launching a shell. The attackers also concealed malicious behavior and erased traces of the intrusion.

The third stage occurred on October 20. The attackers, using Engineer B's compromised computer, controlled Engineer A's and another wallet software engineer C's devices through the company’s internal AI tool, and soon discovered a token with container deployment permissions on Engineer A’s computer.

The fourth stage was on October 30. From 01:15 to 03:56, the attackers logged into Engineer C’s computer and deployed a container using the credentials stolen from Engineer A to execute malicious scripts, officially launching the attack.

Binance also disclosed that since 2026, its security team has detected and blocked 57 suspected cyber threats related to North Korea, employing techniques including fake job interviews, malware masquerading as popular development tools, tampered software packages and browser extensions, and fake video conferencing applications. Source: Binance Preliminary Investigation Report

2. October 30: Signature Service Abused, Withdrawal Suspension Could Not Stop Losses

The report stated that the attackers used unauthorized access to internal wallet signature services to bypass normal withdrawal processes and initiate transactions. Between 04:05 and 04:09, five of Binance's hot wallets transferred 233.46 million XRP to addresses controlled by the attackers; hot wallets on the Solana and Optimism networks transferred approximately 970,500 SOL and 44.2 million OP respectively, while the Bitcoin hot wallet transferred 18,270 BTC. Binance initiated an investigation after receiving internal alerts about large transfers.

Subsequently, the attackers abused the EIP-7702 authorization mechanism of Ethereum using the signature service. EIP-7702 allows accounts to delegate partial execution rights to smart contracts without exposing private keys. The attackers submitted 50 signed transactions, manipulated the account nonce, and established malicious delegated authorizations, enabling the controlled contracts to gain partial execution rights over Binance's affected hot wallets.

This is precisely why Binance was unable to stop losses immediately after suspending withdrawals. Binance mentioned in the report that the malicious EIP-7702 authorization already existed on-chain, operating independently of Binance's normal withdrawal infrastructure; suspending withdrawals and shutting down hot wallet services would not automatically invalidate existing on-chain authorizations; and the affected hot wallets utilized multi-party computation (MPC) technology, with no single private key that could be readily used to revoke authorizations. The team needed extra time to design and implement a revocation process separately.

The last unauthorized transfer of 2,961.9 ETH was confirmed on-chain at 07:56, and this transaction had been broadcast prior and was pending confirmation. At 08:10, Binance executed a new authorization from the Binance14 hot wallet to a null address, clearing the EIP-7702 delegated code, and no further unauthorized transfers were detected thereafter. Binance acknowledged that these challenges extended the time required for overall control of the asset outflow and is reviewing the emergency response process, signature strategy coverage, and hot wallet control mechanisms.

3. Losses and Compensation

Binance stated that the digital assets involved in this incident are valued at approximately $6.34 billion; as of the report's release, about $2.85 billion of assets have been frozen or intercepted, with specific amounts still needing verification and may be affected by market price fluctuations. Binance indicated that it will bear all losses and has reserved over 100% of funds to cover these losses. As of October 31, 98% of the affected token assets have been replenished, and users can verify this through the reserve proof page, with remaining low liquidity assets being purchased. Source: Binance Reserve Proof

The day after the report was released, Binance on November 4 at 23:26 published progress update #7, stating that approximately 98% of the stolen assets have been replenished, but the remaining approximately 2% will see a slower replenishment rate due to low liquidity of the relevant tokens; that day at 08:00 a new snapshot for reserves covering 44 types of tokens was generated, up from 10 types previously. Source: Binance Announcement #7

Compared to statements made on the day of the incident, there were a few changes in the report's wording. Binance's initial report on the morning of October 30 mentioned that the incident might involve the laptop of a DevOps engineer being compromised; the report clarified that it involved the devices of three engineers and was a multi-stage attack spanning five months. In terms of loss amount, blockchain analysis firm TRM Labs previously estimated it to be about $6.36 billion, while the Binance report gave approximately $6.34 billion; the frozen amount also adjusted from approximately $3 billion on that day to approximately $2.85 billion. Source: Techub News Review

As for attribution, Binance cited information from the FBI stating that North Korea is responsible for this incident. According to reports from media such as BleepingComputer, the FBI issued an alert on October 31, attributing the attack to the North Korean hacker group TraderTraitor, and urged exchanges and blockchain analysis firms to intercept transactions related to the addresses involved. Source: BleepingComputer

4. Binance's Rectifications and Future Plans

Binance stated that as of November 3, all attack points utilized in the intrusion have been blocked, and the following measures have been completed: the affected wallet system has been rebuilt in a new environment; the affected internal AI tools have been reconstructed with strengthened access controls; affected devices have been replaced; credentials and tokens related to affected engineers have been disabled; enhanced security scanning of all team devices has been completed; AI-based abnormal behavior detection has been strengthened; wallet service risk controls have been improved; and collaboration is underway with law enforcement, blockchain intelligence agencies, and industry partners to track and freeze assets.

Moving forward, Binance plans to invite independent third-party cybersecurity experts for a thorough review of the incident and to verify the investigation results, increase investments in AI-driven threat detection, endpoint protection, development environment security, and behavioral monitoring, and prepare to establish a security research fund in collaboration with AI companies, industry participants, and security agencies, focusing on AI security in blockchain environments. Binance also stated that to prevent attackers from leveraging relevant information, certain technical details and security measures will continue to be kept confidential.

5. Industry Reaction: "Hastily Put Together" Concerns and Cross-Platform Security Alliance

The report has sparked considerable discussion within the industry. Blanker, a partner at y2z Ventures, posted on X stating he "really likes Binance," but this was “a bit too hastily put together”. He recalled that during his internship at Huobi in 2020, all employees were required to use fortress machines with dynamic MFA, and screens had to be locked when leaving their seats; he always thought this was standard for exchanges, only to discover after reviewing Binance’s account that Huobi was "at least 6 years ahead of the industry" in this respect. Source: blanker

Du Jun, co-founder of Huobi and founder of Vernal Capital, retweeted and responded to this post. He stated that during Li Lin's era at Huobi, security was prioritized, and the customer asset collateral rate was always required to be no less than 105%; approximately 10,000 colleagues participated in building the company over the nine years from 2013 to 2022. However, he also emphasized that security has never been an easy matter, and no institution dares to claim absolute security; the scale of today's industry operations, technical complexity, and attack methods have far surpassed those of the past.

Du Jun believes that customer asset security should not be a competitive point between exchanges but rather a baseline that the entire industry steadfastly upholds. He hopes the industry can promote the establishment of a cross-platform security alliance to form collaborative mechanisms for threat intelligence sharing, risk warnings, emergency responses, and tracking stolen assets, stating, "Competition is competition, security is security. Protecting customer assets is the common responsibility of all practitioners." Source: Du Jun

Binance also responded. On November 4, CZ posted stating that such a large-scale theft indicates serious security failings, "No platform is unhackable, but this cannot be an excuse"; he acknowledged that "some details are embarrassing" and that the public explanation simplified the actual situation, which seemed to be an attack spanning months or even years, targeting hundreds of employees and systems, with only a few ultimately compromised. CZ stated that while sharing these details is uncomfortable, it helps the entire industry learn lessons, and as a stakeholder, he expects Binance to transparently address issues, take responsibility, accept criticism, and make real improvements. Source: CZ

Binance co-founder He Yi also responded that "we all acknowledge" criticism and suggestions regarding Binance's security and permissions management. She stated that many professionals suggested before the report's release that it would be better not to write details, but Binance believes that transparency creates trust. If the report can provide warnings to peers on the complexity of social engineering and the boundaries of AI permissions, then it is meaningful; Binance has reconstructed its security boundaries based on zero trust and least privilege principles in aspects such as departmental permissions management, security environment, devices, and AI tools, and a report will be provided by security audits in the future. Source: He Yi

From Binance's report, it is evident that this attack utilized almost no new technical vulnerabilities: tampered installers, fake interviews, and social engineering are all techniques repeatedly used by North Korean hacker groups, and Binance itself has intercepted 57 such incidents this year. What truly enabled the attack to succeed was the relay of these tactics among three engineers, ultimately linking to the signature service, with internal AI tools functioning as a springboard. Whether the security alliance proposed by Du Jun can be realized remains to be seen, but in terms of threat intelligence sharing, this report itself has already marked a start.

Editor’s Note: The times mentioned in this article are all in Beijing time. The incident timeline, attack chain, and rectification measures are derived from the preliminary investigation report released by Binance on X on November 3 (in Chinese titled "2026年10月30日币安安全事件：调查初步发现与应对进展更新," with an English version released simultaneously). The report mentions that the investigation is ongoing and conclusions will undergo independent review; the FBI attribution is sourced from BleepingComputer reporting; the insights from Du Jun, blanker, CZ, and He Yi are derived from their X posts from November 3 to 4, with Du Jun's statements regarding Huobi's collateral rates and number of employees being his own assertions. This article does not cite reports from Chinese crypto media.

Disclaimer: This is merely an informational report and analysis and does not constitute any investment advice.

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到[email protected]，本平台相关工作人员将会进行核查。