Binance October 2026 breach: $6.3 B drained via a hijacked wallet-signing service

What happened

On Thursday 29 October 2026, Binance, the largest cryptocurrency exchange by volume, disclosed that roughly $6.3 billion of digital assets had been moved out of its hot wallets without authorisation ^[8]. Binance's own initial report puts the impacted amount at approximately $6.34 billion; TRM Labs traced about $6.36 billion, Chainalysis approximately $6.4 billion and Elliptic $6.43 billion, the differences reflecting how each firm priced assets at the moment of transfer ^[1][3][4][6]. On any of those measures it is the largest theft of cryptoassets on record, more than four times the $1.46 billion taken from Bybit in February 2025 ^[6].

The funds left in two waves. Between 20:05 and 20:09 UTC, five Binance hot wallets on the XRP Ledger sent 233.46 million XRP to an attacker-controlled address, and wallets on Solana and Optimism followed shortly after 20:10 UTC ^[1][3]. Most of the value was gone within about 20 minutes, across ten blockchains, according to TRM Labs ^[3]. A second wave reached Binance wallets on Avalanche and Polygon shortly after 23:00 UTC, and the final unauthorised transfer, 2,961.9 ETH, finalised on-chain at 23:56 UTC ^[1][3].

Binance initially said the incident "may involve a compromised DevOps engineer's laptop" that gave an attacker access to a service container used to submit withdrawal transactions, and that it had found no evidence of a private-key leak ^[8]. Within a day the company added that "our subsequent investigation has uncovered additional points of breach" ^[8]. On 3 November Binance published initial findings describing a multi-stage campaign that began in June 2026 and ended with an attacker using stolen credentials to reach an internal wallet-signing service ^[1]. Binance has said it, not its users, will absorb the loss, and that as of its 3 November report approximately $2.85 billion had been frozen or intercepted ^[1].

As of 11 November 2026 the investigation is ongoing: Binance describes its 3 November document as an initial report, says some technical details will remain confidential, and has engaged independent security firms to validate its findings ^[1]. The company has not said how its internal AI tool was used to take control of two further engineers' machines, nor what the "additional points of breach" beyond the three named devices were ^[1][8]. No independent review has reported, no final post-mortem has been published, and Elliptic estimated that around $3.0 billion of the stolen assets remained in attacker-linked addresses as of 10 November ^[1][7].

How they got in

Binance's account of initial access runs from June to September 2026 and involves two separate compromises of engineer workstations ^[1]. In June, an engineer on the Wallet DevOps team, referred to as Engineer A, searched for a popular AI coding tool and downloaded a tampered Homebrew installation to install it ^[1]. Reuters, citing a person familiar with the incident, reported that the malicious version had been placed in a search-engine advertisement so that it ranked above the genuine one ^[18]. Binance's security team detected the anomaly, replaced the device and rotated related credentials, but the company says Engineer A's role, and the identities of his colleagues on the wallet-infrastructure team, had by then been exposed to the attacker ^[1].

The second foothold came through recruitment. In September 2026 a software engineer referred to as Engineer B, whose profile on a legitimate job-hunting platform referenced his Binance experience, was approached by someone posing as a project director ^[1]. A first-round video interview was conducted by a purported HR representative who shared a personal social-media account, including photos and videos, to build trust; Binance describes this as more advanced and deceptive than social engineering it had previously seen ^[1]. A second-round interview with a person claiming to be the CEO of a fictitious company took place in a popular chat application, and near its end Engineer B was instructed to download an "assignment" containing a malicious code repository onto his work computer ^[1].

The repository executed malicious code during setup ^[1]. According to Binance, the script replaced a legitimate development-tool component, the pyenv executable under /opt/homebrew, with a malicious file of the same name, created a new symlink and spawned a shell, giving the attacker command execution and a channel to an external server ^[1]. Binance says the malware was a zero-day that its endpoint-protection tooling did not detect at the time, and that the attacker took steps to remove traces of the compromise ^[1]. Chainalysis describes this pattern, which it calls the "contagious interview", as a tactic DPRK-linked actors have refined on smaller targets, attributing more than $14.3 million of losses over the preceding 18 months to similar fake-interview and malware schemes ^[5].

Binance says it detected and prevented 57 suspected North Korea-linked cyber-threat cases during 2026, involving fraudulent job interviews, malicious software disguised as developer tools, compromised packages and browser extensions and fake video-conferencing applications ^[1]. The two attempts that succeeded both relied on an engineer installing something on a work machine: one via a poisoned search result, the other via a recruiter's coding test ^[1][18].

How it escalated

Binance dates the pivot from endpoint compromise to wallet infrastructure to 20 October 2026 ^[1]. On that day the attacker used Engineer B's compromised computer and an internal AI tool to gain control over the machines of Wallet DevOps Engineer A and a third person, Wallet Software Engineer C ^[1]. Binance has not explained publicly how the AI tool served as a springboard ^[1]. The attacker then discovered that Engineer A's computer held a container-deployment permission token ^[1].

Nine days later, between 17:15 and 19:56 UTC on 29 October, the attacker logged on to Engineer C's computer, used the credentials stolen from Engineer A to deploy a container, and triggered a malicious script ^[1]. That container gave the attacker what Binance calls "unauthorized access to an internal wallet signing service", which was used to initiate transactions outside the normal withdrawal process ^[1]. Binance co-CEO Richard Teng said the attacker "did not simply use one engineer's permissions" and that the operation "was not a single 'one-click' action" ^[8].

The on-chain preparation ran in parallel. TRM Labs and Elliptic both report that a newly created operator wallet received three small withdrawals from the Tornado Cash mixer from 28 October ^[3][6]. At 15:59 UTC on 29 October the attacker deployed a "sweeper" contract, having tested an earlier version on two wallets and rehearsed the final version on a third roughly four hours before use ^[3][6]. TRM's assessment is that preparation began at least 36 hours before the theft ^[3].

The signing-service access was then used across every chain. On nine of the ten affected blockchains, Binance wallets sent funds to the attacker through ordinary, validly signed transactions; on Ethereum, the attacker used the signing service to obtain 50 EIP-7702 authorisations from the hot wallet known as Binance 14 ^[1][3]. Because those wallets use different chains, key types and signing schemes and all produced valid signatures for the attacker within about half an hour, TRM concluded that the most likely explanation is that the attacker could make Binance's hot-wallet signing system sign transactions of its choosing ^[3]. Elliptic reached the same conclusion, noting that a second Ethereum hot wallet, Binance 16, sent 28,006 ETH and other tokens worth about $174 million directly to the attacker, signed with its own key ^[6].

What the attackers did next

The Ethereum leg relied on EIP-7702, a feature introduced in the 2025 Pectra upgrade that lets an ordinary account delegate execution to a smart contract without exposing its private key ^[1][6]. At 20:20 UTC the attacker submitted a single transaction carrying 50 authorisations, each signed by Binance 14 and each covering a different nonce so that one would match the wallet's transaction count when it landed ^[6]. Three and a half minutes later the sweeper contract emptied the wallet of 167,464 ETH and 63 tokens, including about 1.6 billion USDT, in a transaction Elliptic values at $2.53 billion ^[6]. Because the delegation stayed in place, no further signatures were needed: the attacker used Binance 14's owner rights to pull 823 million USDC from another Binance wallet and swept new deposits four more times, the last at 23:56 UTC ^[6].

What followed was a race against stablecoin issuers. Chainalysis reports that the attacker moved $500 million of stablecoins into a wallet dedicated to swapping them for assets that cannot be frozen, converting $325 million into $285 million of ETH in under 20 minutes ^[4]. Elliptic puts total conversions before the freezes landed at about $786 million, including 434 million USDT swapped for 160,451 ETH through Uniswap, 1inch and market-maker request-for-quote systems at implied discounts of 12% to 26%, 59.9 million USDT posted to Aave to borrow 19,762 ETH, and 234 million USDT swapped for TRX on SunSwap ^[6][7].

The freezes arrived quickly. Tether froze the attacker's main Ethereum wallet 37 minutes after the stolen USDT arrived, locking 1.18 billion USDT, then followed the funds to four more addresses within 17 minutes; Circle froze all 823 million USDC three minutes after that ^[6][7]. Ripple, World Liberty Financial, Paxos and First Digital froze further stablecoins, the Arbitrum Security Council moved 8,426 ETH and 74.6 million ARB out of the attacker's reach, and Optimism governance appears to have recovered 44 million OP ^[3][6]. Binance and Elliptic both put the frozen or intercepted total at $2.85 billion, about 44% of the theft; Chainalysis reported about $2.8 billion as of 3 November and TRM about $2.7 billion as of 30 October ^[1][3][4][6].

Laundering of the remainder has been automated and, so far, slow. Elliptic reported that in the first four days the funds passed through roughly 12,000 wallets and 40,000 transactions on 11 blockchains, about one new wallet every 25 seconds, with Tron the main route: 684.6 million TRX was spread across about 7,700 addresses before being bridged to Ethereum ^[7][13]. By 10 November the count was more than 20,000 wallets on 16 blockchains and at least 65,000 transactions, with some bitcoin passed through coinjoins, ETH and SOL through the Privacy Cash pool and, since 8 November, about 11,000 ETH into Tornado Cash ^[7]. The 18,270 BTC, split into 19 addresses on the night of the theft, had not moved, and Elliptic estimates that around $3.0 billion remains in theft-linked addresses with a negligible amount cashed out ^[7]. Elliptic reads the fixed timing, set amounts and blind retries as conventional scripts rather than AI agents ^[7].

Detection and response

Binance says it received an internal alert for large-volume transfers after the XRP, SOL and OP wallets had been drained and began investigating immediately ^[1]. Its report does not give a time for the alert, and the sequence it describes places the 18,270 BTC transfer and the EIP-7702 delegation after it ^[1]. Time-to-detect for the on-chain phase was therefore minutes; time-to-detect for the intrusion itself was closer to four months, counting from the June compromise that Binance caught but did not treat as a wider breach of its wallet team ^[1].

Containment ran into a problem specific to the Ethereum leg. Binance suspended withdrawals, coordinated freezes with issuers and revoked permissions, but the EIP-7702 authorisations existed on-chain and operated independently of Binance's withdrawal infrastructure, so pausing withdrawals did not stop them ^[1]. Because the hot wallet used multi-party computation, there was no single private key with which to revoke the delegation, and the team had to develop and execute a specialised procedure, which took additional time ^[1]. Binance's chief security officer Jimmy Su told reporters that this is why containment took until 00:10 UTC on 30 October, when Binance executed a new authorisation from Binance 14 to the zero address to clear the delegation code ^[1][12]. Teng also said the attacker's tooling used a self-destruct mechanism that destroyed traces as it ran ^[6].

Industry freezes were faster than Binance's own revocation. Chainalysis records the first freezes by 21:14 UTC, roughly an hour after the first outflow ^[4]. On 31 October the FBI, together with the US Secret Service and IRS Criminal Investigation, published a list of attacker addresses and urged THORNode operators, RPC node operators, instant exchanges and DeFi services to block transactions derived from them ^[2]. The FBI and Secret Service were both assisting Binance in tracing the funds ^[9].

On the customer side, Binance said on 30 October that it had reserved more than $6.34 billion of company funds, around $5 billion of it already held in the same tokens that were stolen ^[6]. It reported 90% of impacted assets covered on 31 October, with its ten largest tokens, BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC, backed 1:1, and 98% as of its 3 November report, drawing on its Secure Asset Fund for Users (SAFU), part of its futures insurance fund and corporate treasury ^[1][10][14]. Withdrawals resumed in phases from Sunday 1 November, beginning with the Bitcoin network and then Ethereum and BNB Smart Chain ^[14]. As of 3 November Binance had rebuilt the affected wallet system in a new environment, rebuilt the internal AI tool and its access controls, replaced affected devices, decommissioned the engineers' credentials and tokens and scanned all employee devices ^[1].

Impact

Money. The impacted amount is $6.3 billion by Binance's first estimate, $6.34 billion in its report, and between $6.36 billion and $6.43 billion by independent tracing ^[1][3][4][6]. Of that, $2.85 billion is frozen or intercepted and about $3.0 billion remains with the attacker, mostly as ETH and BTC that no issuer can freeze ^[1][7]. Binance has said it will absorb the loss, and Elliptic notes that the $6.34 billion reserved by the company excludes any frozen assets that may later be recovered ^[1][6].

Users and liquidity. Withdrawals were suspended globally from the night of 29 October until Sunday 1 November ^[9][14]. Reuters reported that customers withdrew a net $4.72 billion from the exchange after it reopened ^[11]. Binance published a Proof of Reserves snapshot covering its top ten tokens and said users could verify that their assets were backed at a minimum 1:1 ratio ^[10].

Attribution. The FBI stated on 31 October that the DPRK was responsible, under the activity name TraderTraitor, and that the same actors were converting stolen assets primarily into ETH ^[2]. TRM Labs and Chainalysis had attributed the attack to TraderTraitor with high confidence on 30 October, based on on-chain and off-chain intelligence and, in Chainalysis's case, on stolen Binance funds commingling in real time with proceeds of the September 2026 Bitget theft ^[3][4]. Elliptic assessed the same group as the likely perpetrator before the FBI statement, citing common service use with earlier TraderTraitor thefts from BigONE, WOO X and AFX ^[6]. Check Point Research's weekly bulletin described the incident as linked to a North Korean group, and Check Point's APAC CISO Jayant Dave said the unit is also known in the industry as Lazarus Group ^[8][15]. Pyongyang rejected the FBI's attribution; Kim Yo Jong called it a "grave political provocation", according to KCNA as reported by Yonhap ^[13].

Market and sector. BBC reported that Bitcoin fell by more than 4% following the alerts, with Ethereum and Solana also falling sharply ^[8]. Binance.US and Coinbase said they were unaffected ^[8]. Binance says it is engaging independent third-party experts, increasing investment in endpoint protection and developer-environment security, and establishing a security research fund with AI companies and security firms ^[1].

Root cause

Three controls failed, and one of the failures was visible four months before the theft. First, developer and DevOps workstations were allowed to hold credentials that could reach wallet infrastructure: a container-deployment token sat on Engineer A's laptop, and once the attacker had that token and a foothold on Engineer C's machine, deploying a container was enough to reach the signing service ^[1]. Second, the signing service signed what it was asked to sign. On nine chains it produced valid, ordinary transfers to attacker addresses, and on Ethereum it produced 50 EIP-7702 authorisations that, in Teng's words, "did not pass through our normal approval controls" ^[3][6]. A signer that does not check that each request originates from the withdrawal system, corresponds to a customer withdrawal and stays within velocity limits is not a control; it is a key with extra steps.

Third, the June compromise was handled as a device incident rather than as the opening of a campaign. Binance replaced the laptop and rotated credentials but, on its own account, the wallet team whose identities had been collected remained exposed ^[1]. Check Point's Dave, who has tracked seven major crypto thefts since 2024, told Business Standard that none broke the cryptography and five began with a staff member's or supplier's device, token or session ^[16]. The endpoint-protection miss on a zero-day and the absence of a rehearsed EIP-7702 revocation procedure for MPC wallets lengthened the incident, but they are secondary ^[1]. The primary failure is that a developer laptop, an internal AI tool and a deployment token together formed a path to the signer with no independent check along it ^[1].

Lessons for Indian firms

India has a direct precedent and a live warning. WazirX lost about $235 million from a multi-signature wallet in July 2024 ^[16]. On 4 November 2026 CERT-In issued Advisory CIAD-2026-0058, rated Critical, on an AI-assisted actor it calls CRAFTY FALCON that has targeted NBFCs, fintechs, payment aggregators and cryptocurrency exchanges, stealing wallet keys and siphoning funds, with attacks timed for holidays and weekends ^[17]. Its recommendations overlap closely with the Binance findings: store wallet keys in HSMs or cold custody and require multi-signature approval for withdrawals; prohibit hard-coded tokens and use short-lived, least-privilege deployment credentials with alerting on unusual use; isolate non-production environments from production; and adopt zero-trust segmentation on the assumption that the actor is already inside ^[17]. Kaspersky's GReAT reports that its GhostCall and GhostHire campaigns, which use fake calls and fake recruiters, have targeted Web3 and crypto organisations in India since at least April 2025 ^[16].

On the regulatory side, CERT-In's 2022 directions require incidents to be reported within six hours and logs to be retained for 180 days; virtual-asset service providers must register with FIU-IND and keep KYC and transaction records for five years; and 2026 guidelines add a cybersecurity audit by a CERT-In-empanelled auditor ^[16]. On the Binance timeline, the six-hour clock would have started during the on-chain phase, before the Ethereum wallet had been reclaimed, so the reporting template and the CSIRT-Fin contact need to exist before the incident does ^[1][17].