Переходьте на seedless. Знижка 30% з SWITCH30 до 04 лист.Binance Hack 2026: How Attackers Stole $6.34B
Ця стаття доступна такими мовами:
On October 29, 2026, Binance suffered a hot wallet breach that resulted in the theft of approximately $6.3 billion to $6.43 billion across 10 blockchains, marking it the largest cryptocurrency theft in history.
Binance hack timeline
The attacker transferred most of the funds within roughly 20 minutes. The events below are listed in the order they occurred.
| Time (UTC) | Event |
|---|---|
| Oct 29, 17:15 to 19:56 | The attacker deploys a container and triggers a script that reaches the wallet signing service. Binance gives no time zone for this window. |
| Oct 29, 20:05 | Funds start to leave. Wallets on the XRP Ledger are hit first. |
| Oct 29, 20:05 to about 20:25 | Wallets on Solana, Optimism, Bitcoin, Tron, and Ethereum follow. Arbitrum and Base are also hit. |
| Oct 29, about 23:05 | A second wave hits Avalanche and Polygon. |
| Oct 29, 23:56 | The last unauthorized transfer, 2,961.9 ETH, settles. |
| Oct 30, 00:10 | Binance clears the attacker's delegation on the hot wallet. |
| Oct 30 | Binance confirms the incident. It suspends deposits and withdrawals. It reports about $3 billion in frozen assets. |
| Oct 31 | The FBI names North Korea. Binance reports 90% of impacted assets have been replenished. |
| Nov 1, 06:00 | Binance resumes withdrawals in phases. |
| Nov 3 | Binance publishes its initial findings and response update. |
| Nov 4 | Binance publishes a seventh recovery update. It reports 98% replenished. |
How the attacker got in
Binance describes a multi-stage campaign that ran from June to October 29, with three engineers' computers sitting on the attack path.
The engineers are labeled A, B, and C. Engineer A is a wallet DevOps engineer, B is a software engineer, and C is a wallet software engineer. Here's how the hack unfolded:
- June, tampered tool: Engineer A searches for a popular AI coding tool and installs a tampered Homebrew package. A person familiar with the incident told Reuters that the malicious version appeared above the real one in search results, in an advertisement. Binance detects the problem, replaces the device, and rotates credentials. The attacker learns the role of Engineer A and his wallet infrastructure colleagues.
- September, fake recruiter: A person who poses as a project director contacts Engineer B on a legitimate job platform. In the first interview, a fake HR representative shares a social media account with personal photos and videos. Binance says this approach was more advanced than earlier social engineering.
- September, fake CEO: A second interview takes place on a popular social chat app with a person who poses as the CEO of the fake company. At the end, the "CEO" tells Engineer B to download an assignment. The assignment is a code repository that contains malware.
- Infection: The code runs on Engineer B's work computer during setup. It replaces a legitimate development tool component with a malicious version. The report's script shows the pyenv tool, installed through Homebrew.
- Stealth: The malicious version runs commands and contacts an attacker-controlled server. It hides its script. Binance's endpoint security tools did not detect it at first.
- October 20, lateral move: The attacker uses Engineer B's computer and an internal AI tool to take control of Engineer A's and Engineer C's computers. The attacker finds a container deployment permission token on Engineer A's computer.
- October 29, the theft: The attacker gains access to Engineer C's computer. The attacker uses Engineer A's stolen credentials to deploy a container. A script in the container initiates the attack using an advanced transaction authorization method.
The first transfer moved 233.46 million XRP from five hot wallets to a single attacker's address in four minutes. An internal alert about large transfers started Binance's response. Binance then suspended withdrawals, froze affected tokens, and removed unauthorized permissions.
Binance reports these fixes. It rebuilt the compromised wallet system and the internal AI tool. It replaced the affected devices and decommissioned all credentials and tokens of the compromised engineers. Independent cybersecurity experts now review the incident.
Binance did not name the job platform, the chat app, the AI coding tool, or the internal AI tool. It links to a SANS write-up about a fake Homebrew site served through a search ad. It does not say that the campaign reached Engineer A.
What's a signing service & EIP-7702 delegation?
A signing service is an internal system that digitally signs blockchain transactions. Funds move on a blockchain only when a valid digital signature authorizes the transaction.
An exchange does not sign each withdrawal by hand. Software receives a request, checks it against rules, and signs it with the wallet’s key material. Binance’s hot wallet used multi-party computation (MPC), which splits key control across several parties so no single key exists.
The attacker accessed this service from a container running under stolen credentials. The service then signed what the attacker requested, including the 50 transactions that set up the EIP-7702 delegations.
EIP-7702, introduced in Ethereum’s Pectra upgrade, allows a regular crypto wallet (an Externally Owned Account, or EOA) to temporarily borrow and execute smart contract code.
The service let the attacker send funds outside the normal withdrawal process. It also signed 50 transactions that set up EIP-7702 delegations.
Attribution
The FBI said on October 31 that North Korea carried out the attack, linking the activity to the TraderTraitor group. Binance says it detected and blocked 57 suspected North Korea-linked cyber threats in 2026. On November 2, North Korean politician and diplomat Kim Yo Jong rejected the accusation in a statement carried by state media KCNA.
What the analytics firms report
- Chainalysis puts the theft at about $6.4 billion. That equals about 95% of the $6.75 billion it counts for North Korean hackers through 2025.
- Chainalysis found stolen funds intermingled onchain with funds from last month's Bitget theft.
- The attacker swapped $325 million in stablecoins for $285 million in ETH over nearly 20 minutes. This kept the funds ahead of freezes.
- Laundering shows signs of automation. Thousands of transactions ran in a short period, and many addresses first received exactly 1 TRX.
- Elliptic counts about 12,000 wallets, 11 blockchains, and more than 40,000 transactions. As of November 2, about $3.24 billion sat in linked addresses, mostly ETH and BTC.
Fund recovery
Binance set aside more than $6.34 billion to cover losses, drawing on its SAFU emergency fund, Futures insurance fund, and treasury. As of November 4, they report that 98% of impacted tokens have been replenished. Binance chairman Changpeng Zhao says the company did not borrow money, sell assets, or raise outside funds.
Stablecoin issuers and networks acted within the first hour, intercepting or freezing $2.85 billion. The frozen funds have not yet been returned to Binance as the attacker converted the remaining funds into assets that issuers cannot freeze, such as ETH.
Withdrawals and outflows
Binance resumed withdrawals in phases beginning November 1. According to co-CEO Richard Teng, withdrawal activity had returned to normal levels by November 3. Customers withdrew a net total of $4.72 billion through November 2, representing approximately 3% of the platform’s assets, primarily in USDT.
Lessons for users
The attack hit a custodian's internal operations, and the blockchains worked as designed. Binance lost hot wallet funds with no private key leak, so exchange balances carry custodian risk. Self-custody removes exchange-level operational risk and makes the holder directly responsible for their security.
Scammers follow every large hack. Ignore unsolicited messages about recovery or withdrawals, and use official channels only.
Tangem as a go-to self-custody option
Self-custody ensures complete control over your private keys, effectively removing centralized exchanges from your chain of trust.
Tangem delivers self-custody security through a sleek hardware wallet, available as an NFC-enabled card or ring. The wallet generates your private key with high entropy and stores it securely on an EAL6+ certified secure element chip. Reflecting this uncompromising security standard, Tangem has maintained a flawless record with zero breaches since its founding.
References
