On October 29–30, 2026, assets worth approximately $6.34 billion left Binance hot wallets. In its November 3 preliminary report, the exchange described a campaign involving a tampered Homebrew installer, fake recruitment interviews, compromised employee computers and access to its wallet signing service. On Ethereum, malicious An Ethereum rule allowing a regular wallet address to delegate execution to selected smart-contract code. Applications can use it to add smart-wallet functions, including fee payment through an intermediary. authorizations persisted on-chain, allowing asset movements to continue after normal withdrawals were suspended.
Eugen Voyager
Contents
How the attackers reached the wallet team
June: a tampered Homebrew installer
A wallet engineer was looking for an AI coding tool. While installing it, he downloaded a tampered installer for Homebrew, a package manager used on macOS. Binance’s security team detected suspicious activity, replaced the device and rotated the related credentials.
During that compromise, however, the attackers learned the engineer’s role and identified colleagues working on wallet infrastructure. They could now target specific members of the team.
September: interviews for a fictitious company
Another engineer was approached through a legitimate job platform. His profile mentioned his experience at Binance. A person posing as a project director arranged two interviews: first with an apparent HR representative, then with someone claiming to be the CEO of a fictitious company.
The first interview was a live video call. To build trust, the supposed recruiter shared a social media account containing personal photos and videos. At the end of the second interview, the engineer was asked to download a coding assignment onto his work computer.
The repository ran malicious code during setup. It replaced a component of pyenv, a tool for managing Python versions, and connected the computer to an attacker-controlled server. According to Binance, endpoint protection did not detect the malware at the time, and the attackers concealed traces of their activity.
October 20: reaching more employees
Using the compromised computer and an internal Binance AI tool, the attackers gained control of two more wallet engineers’ devices. On one computer they found a token permitting container deployments inside Binance’s infrastructure. Containers are isolated environments used to run programs.
Access to an employee’s computer had become a route to running attacker-controlled code close to the systems serving the exchange’s wallets.
October 29: wallet signing access and transfers across networks
Between 17:15 and 19:56 UTC, the attackers logged into an engineer’s computer, used previously stolen credentials, deployed a container and launched a malicious script. They gained unauthorized access to the internal wallet signing service and could initiate transactions outside the normal customer withdrawal process.
Binance’s report lists several parts of the attack:
- Between 20:05 and 20:09 UTC, five hot wallets sent 233.46 million XRP to an attacker-controlled address.
- Wallets on Solana and Optimism sent approximately 970 500 SOL and 44.2 million OP.
- A separate transfer moved 18 270 BTC.
- On Ethereum, the attacker used EIP-7702 to assign attacker-controlled smart contract code to a Binance hot wallet.
Hot wallets connect to the exchange’s operational infrastructure to support routine transfers. Here, the attackers reached the system capable of authorizing transactions across several networks.
What EIP-7702 changed for the Binance wallet
EIP-7702 allows an ordinary Ethereum account to execute selected A program recorded on a blockchain. It performs defined actions with funds and data when called, such as exchanging tokens according to an application’s rules.. A signed authorization installs the delegation, after which the assigned program determines the wallet’s behaviour.
With access to Binance’s signing service, the attacker obtained authorization to install malicious code on Binance 14. That code could collect ETH and tokens and send them to a recipient. Once the permission existed on-chain, each subsequent sweep could execute without going through the exchange’s normal withdrawal process again.
New deposits were exposed as well. That night, researcher Wazz reported roughly $50 million deposited into Binance 14 and then swept by the attacker.
Why suspending withdrawals did not immediately stop the attack
Binance suspended customer withdrawals, coordinated asset freezes with partners and began revoking unauthorized permissions. Existing EIP-7702 authorizations, however, operated on-chain independently of its normal withdrawal infrastructure.
The report also describes a complication involving Multi-Party Computation, or MPC, where several participants jointly produce a signature. Binance developed a separate procedure to revoke the malicious authorizations. Shutting down hot wallet services did not itself remove permissions already recorded on the blockchain.
According to the report, the final unauthorized transfer of 2 961.9 ETH was confirmed at 23:56 UTC on October 29. Binance says it had been broadcast earlier and remained pending before confirmation. At 00:10 UTC on October 30, Binance authorized delegation to the zero address from Binance 14, clearing its delegation code.
Where the assets went and what could be frozen
Stolen tokens were traded and moved among addresses and networks. Chainalysis described thousands of rapid transactions and repeated transfers through previously used addresses. Its investigators suggested automation was being used to make the trail harder to follow.
Stablecoin issuers and network teams helped restrict asset movements. For example, the Arbitrum Security Council moved 74 559 805 ARB and 8 425 ETH into an intermediary frozen wallet. Further transfers require action by the council or an Arbitrum governance vote.
In its November 3 report, Binance put frozen or intercepted assets at approximately $2.85 billion. This is a separate measure from the funds the company uses to replenish affected user holdings.
Binance Hack Watch tracks transfers among known exploiter addresses on Ethereum, token sales and remaining assets. Its tables use Pacific time.
What Binance replenished using company funds
Binance committed to absorb the financial impact and says it allocated more than the amount required to cover the loss. Its report states that 98% of the impacted token assets had been replenished by October 31. Purchases of the remaining, less liquid assets were continuing. Replenishment uses Binance’s resources, while recovery of stolen funds is a separate process.
Withdrawals began reopening in phases on November 1 at 06:00 UTC. On November 3, Binance announced more network–asset pairs reopening on Ethereum and Solana and said the phased rollout would continue. Deposits are operating. Withdrawal availability depends on the specific asset and network.
Who is investigating and what Binance changed
Binance’s preliminary report attributes the incident to North Korea, citing the FBI. Separately, the US Secret Service confirmed that it was investigating the theft alongside the FBI, IRS and Department of Justice.
Binance says it rebuilt the affected wallet system in a new environment, rebuilt the internal AI tool and its access controls, replaced devices and revoked the credentials and tokens associated with the compromised engineers. It is engaging independent cybersecurity specialists to review the findings.
The central thread is the path from developer computers to wallet signing authority. A tampered installer exposed the team, a coding assignment compromised a work device, and stolen deployment permissions brought the attackers closer to wallet operations. EIP-7702 then established access on Ethereum itself, where those permissions required a separate revocation.
More incidents and attack mechanisms are covered in Yieldo’s security section.
EV
Eugen Voyager
Crypto analyst and blockchain developer. In the industry since 2018. Creator of Telochain blockchain, GameFi project Telomeme, and Yieldo platform. Author of Telegram channel @tonsdot.
How we collect and check data — Yieldo's methodology.
How we publish, date and correct material — editorial policy.