Cryptocurrency exchange Binance has published a preliminary report on the security incident that took place on 29 October. Cryptocurrencies are highly volatile.
Scale of losses and asset coverage
The attack affected digital assets worth approximately $6.34 billion. At the time of publication about $2.85 billion had been frozen or intercepted.
“We have reserved more than 100% of the funds required to cover the losses. As of 3 November, 98% of the affected tokens have already been restored, and their backing can be verified on the Binance Proof of Reserves page,” the company said. Assets that are missing will be repurchased by the exchange, as some of them have low liquidity.
Mechanics of the cyberattack
The attack unfolded quickly and affected multiple blockchain networks through unauthorised access to an internal transaction-signing service for hot wallets. Between 20:05 and 20:09 UTC five hot wallets transferred 233.46 million XRP to an address controlled by the attackers.
Subsequently, the exchange’s hot wallets on the Solana and Optimism networks also sent approximately 970.5 thousand SOL and 44.2 million OP to addresses controlled by the hackers. After the large transfers were detected, the exchange received an internal alert and launched an investigation, and one of the hot wallets moved 18,270 BTC.
Why the transfers could not be stopped immediately
After detecting the attack the exchange suspended withdrawals, coordinated with partners to freeze tokens and began revoking unauthorised approvals. However, pausing withdrawals was insufficient because the unauthorised EIP-7702 approvals had already been recorded on-chain and operated independently of the standard withdrawal infrastructure.
The attackers submitted 50 signing transactions to manipulate the nonce counter and create malicious delegation approvals that allowed them to continue transfers without using standard services. Stopping such operations required creating additional transactions and performing a specialised approval-revocation procedure, which took time.
Stopping unauthorised transfers and investigation findings
The final unauthorised transfer of 2,961.9 ETH was finally confirmed on-chain at 23:56 UTC. On 30 October 2026 at 00:10 UTC the exchange executed a new authorization from the hot wallet Binance14 to the zero address, which allowed it to clear the EIP-7702 delegation code and revoke the related approvals.
The investigation showed that the attackers prepared the operation in advance and used multiple methods of intrusion: fake interviews, malware deployments, compromise of internal artificial-intelligence-based tools and access to employees’ devices.
