This content comes from Binance Co-CEO He Yi, Richard Teng, and Chief Security Officer Jimmy Su in Binance's public space, responding to the significant security incident that occurred on October 30. Binance stated that attackers circumvented normal withdrawal processes by infiltrating the internal wallet signature service, transferring approximately $6.34 billion in crypto assets.

Source: Binance

整理：吴说

This content comes from Binance Co-CEO He Yi, Richard Teng, and Chief Security Officer Jimmy Su in Binance's public space, responding to the significant security incident that occurred on October 30. Binance stated that attackers circumvented normal withdrawal processes by infiltrating the internal wallet signature service, transferring approximately $6.34 billion in crypto assets. As of the time of sharing, approximately $2.85 billion in assets have been frozen or intercepted. Binance pledged to bear the losses itself, stating that nearly 98% of the affected token assets have been replenished, with no gaps in user funds, and withdrawal services have been restored.

Jimmy introduced that the attacker allegedly induced an engineer to run malicious code on a work computer through fake recruitment and technical interviews, thus gaining access to internal system privileges. The attackers also used on-chain authorization mechanisms to continue transferring funds after Binance paused withdrawals. Binance believes that the incident involves a hacker organization with national backing and stated that its security team had blocked 57 suspected cyberattacks linked to North Korea in 2026.

He Yi stated that although some internally were concerned that disclosing technical details might bring additional risks, she insisted on increasing event transparency. Binance plans to rebuild the relevant wallet infrastructure, strengthen internal system isolation, and introduce independent security reviews. When talking about future development, He Yi believes that the crypto industry needs to pay more attention to real business value, and the integration of RWA, perpetual contracts for stocks, and traditional finance with the crypto market will be an important direction.

The following amounts, attack attribution, asset recovery status, and security measures mainly come from public statements by Binance's management and do not represent independent investigation conclusions.

Guest speeches do not represent the views of Wu Shuo and do not constitute any investment advice; please strictly comply with local laws and regulations.

$6.34 billion in assets affected, Binance claims approximately $2.85 billion has been frozen or intercepted

Host Jessica: Can you introduce what actually happened on October 30, and what is the current processing progress at Binance?

Richard Teng: This incident should not have happened, and we take full responsibility for it.

On October 30, attackers gained unauthorized access to the internal wallet signature service and initiated transactions outside the normal withdrawal process. Upon detecting an abnormal large fund transfer, we immediately launched an investigation, suspended withdrawals, and coordinated with partners to freeze related assets.

This incident involved approximately $6.34 billion in digital assets. As of now, approximately $2.85 billion has already been frozen or intercepted, and relevant work is still ongoing.

We have decided that Binance will bear all financial losses and will not let users bear losses.

The rapid progress of this fund freeze could not have happened without the cooperation of stablecoin issuers, blockchain analysis companies, and law enforcement agencies. The transparency of on-chain transactions allows parties to track the flow of funds in real-time and coordinate actions.

Jessica: He Yi, what was your reaction when you first learned about the attack incident?

何一: At that time, it was midnight in Abu Dhabi, and I was preparing to go to sleep. While scrolling through X, I saw many people discussing whether Binance had been hacked. I immediately checked the internal work group and found that the team had already begun investigating and handling it.

As a non-technical background manager, my primary concern at that time was whether user assets were safe and how to explain the situation to the community.

Although we initially didn't know the final loss amount, we quickly communicated with major shareholders and board leaders, deciding to make a public commitment that Binance would bear the losses and ensure that users would not suffer asset losses.

At that time, the attack was still ongoing, and we were continuously updating the situation. Tether, Circle, USD1, and industry partners like Aave, Arbitrum, and Polygon quickly provided assistance, with some assets being frozen or intercepted within a few hours.

This made me feel that although the crypto industry is usually highly competitive, during significant security events, all parties in the industry can still cooperate swiftly.

Binance claims user funds are intact, 98% of affected token assets have been replenished

Jessica: Users are most concerned about the safety of their funds. How can Binance prove that user assets are still protected? Is the suspension of withdrawals similar to the situation with FTX in previous years?

Richard Teng: Our position is very clear: there are no gaps in user funds.

The assets affected are Binance's own wallets and asset positions, not user funds. The vast majority of user assets remain stored in cold wallets, and we have found no evidence of wallet private key leaks or user data leaks.

Currently, we have reserved funds exceeding the necessary amount to cover losses, and approximately 98% of the affected token assets have been replenished. The remaining approximately 2% is mainly low liquidity assets, requiring more time for procurement and replenishment, but funding guarantees have been obtained for those as well.

Users can verify the relevant balances through the Proof of Reserves published by Binance.

As for the suspension of withdrawals, I don't think it can be simply compared to FTX. The issue with FTX at the time was a gap in customer funds, while Binance's suspension of withdrawals was to control the security incident and protect existing funds.

We restored withdrawal services once we confirmed the relevant system's safety. The suspension was a risk control measure and did not mean that the platform lacked solvency.

Fake recruitment breached engineer's computer, on-chain authorization allowed attacks to continue after withdrawals were paused

Jessica: Binance has a large security team and years of security investment; how did the attackers breach the defenses?

Jimmy Su: This was a targeted attack lasting several months, not an ordinary random internet scam.

In September of this year, a software engineer received contact from a so-called project manager through a legitimate recruitment platform. The attacker knew he had a background working at Binance, thus this contact was clearly targeted.

The engineer then attended two rounds of interviews. The first round was a video conversation with a fake HR person, who also provided social media accounts with personal photos and videos to establish trust. The second round was conducted via social media, where another attacker impersonated the CEO of a fictitious company.

As the interview was nearing its end, the other party asked the engineer to download a coding assignment on his work computer. In reality, this code repository contained malicious programs that were executed during installation and configuration.

The malicious program executed commands by replacing components of the normal development tools and communicated with external servers controlled by the attackers. We believe that zero-day malware was used, which was not detected by third-party endpoint security products at that time. The attackers also took measures to hide traces of their activities, increasing the difficulty of investigation.

Since the beginning of this year, our security team has identified and blocked 57 suspected cyberattacks related to North Korea, including fake recruitment, malware disguised as development tools, malicious code implanted in software packages and browser extensions, and counterfeit video conferencing applications.

These attacks indicate that social engineering attacks targeting employees have become significant risks faced by the industry.

Jessica: Why were the attackers still able to continue transferring assets after Binance paused withdrawals?

Jimmy Su: This is one of the most important technical lessons from this incident.

The attackers utilized an on-chain transaction authorization mechanism. Pausing withdrawals could only prevent Binance's own withdrawal infrastructure from processing new requests, but the malicious authorizations previously established by the attackers already existed on-chain and no longer relied on Binance's withdrawal system.

Therefore, although pausing withdrawals was necessary, it was not sufficient to completely stop the attack.

We had to revoke these authorizations through additional on-chain transactions. However, the affected hot wallets utilized multi-party computation (MPC) architecture, which did not have a single full private key that could be used immediately to revoke authorizations.

The security team had to design and execute a special revocation procedure in an extremely short time, which is also why it took several hours to stop the funds from continuing to flow out rather than just a few minutes.

We hope to make this technical issue public to inform other platforms using similar wallet architectures about the associated risks.

AI simultaneously enhances attacks and defenses, He Yi insists on disclosing security incident details

Jessica: What role did AI play in both this attack and security defenses?

Richard Teng: AI is both a tool for attack and a tool for defense.

AI is changing the cost structure of cyber attacks, enabling attackers to launch complex attacks faster and on a larger scale. Tasks that previously required professional teams can now be accomplished through automated tools, making social engineering attacks more realistic.

But the same technology can also help security teams identify anomalous behavior, track funds, and improve response efficiency.

Therefore, we are increasing investments in AI anomaly detection, behavior monitoring, and endpoint security, and collaborating with AI companies and cybersecurity firms.

No institution can guarantee 100% security, but we must continue to improve our defense systems.

Jessica: He Yi, why do you insist on disclosing technical information?

何一: In fact, some senior managers and legal teams internally advised against disclosing too much technical detail in public reports, but I did not accept this advice.

I believe that one important reason Binance has gained the community's trust over the past nearly ten years is our willingness to openly face issues.

When mistakes occur, we should acknowledge them and improve, rather than try to hide. If disclosing more information can help other platforms understand attack methods and improve security levels, then it is meaningful.

I am responsible for the HR team and have encountered similar suspicious recruitment cases. For example, the person who appeared during the interview was not the same person who showed up at the office later; there were also discrepancies between candidate identity information and online environments, and after we conducted further verification, the individual suddenly lost contact.

These situations indicate that attackers may conduct long-term research on corporate recruitment and internal management processes, using identity deception to seek opportunities.

AI may be used as a weapon by attackers but can also serve as a shield for defenders. We need to continuously enhance our security capabilities while sharing experiences with the industry.

Rebuild wallets and internal systems, introduce independent security reviews

Jessica: What corrective measures has Binance taken? How can similar incidents be avoided in the future?

Jimmy Su: As of November 3, we have completed several emergency corrections.

First, we are rebuilding the affected wallet systems and internal AI tools in a new environment, and strengthening access control. At the same time, we are replacing the affected employees' devices, revoking related credentials and access tokens, and conducting enhanced security scans on employee devices.

We have also upgraded our AI-based anomaly detection and risk control measures for wallet services, continuing to work with law enforcement, on-chain analysis firms, and industry partners to track related assets.

In the longer term, the focus is on strengthening system isolation, including differentiating internal and external network traffic, isolating work content from sensitive data, and strengthening document storage and network access control on corporate devices.

The core principle is that even if a single employee's device is compromised, it should not evolve into a systemic security incident.

Next, there are three main directions.

First, we will engage external security experts to conduct an independent review, verify the incident investigation results, and propose further improvement recommendations. We cannot rely solely on our internal team to judge whether the system is safe.

Second, we will increase our investment in AI security, focusing on enhancing threat detection, endpoint protection, development environment security, and anomaly behavior monitoring. This incident indicates that internal AI tools and development environments must also be viewed as critical infrastructure.

Third, strengthen industry cooperation. We are promoting the establishment of a security research fund and plan to cooperate with AI companies, security agencies, and other industry participants to study AI security threats in the blockchain environment.

Additionally, we will re-examine our wallet signature policies, hot wallet control mechanisms, and incident response processes to shorten the time required for future detection, control, and handling of attacks.