Binance details $6.34 billion security incident and recovery

Binance’s Nov. 3 incident update says unauthorized wallet transfers on Oct. 29 affected about $6.34 billion in digital assets, with $2.85 billion frozen or intercepted and the exchange saying it will cover the losses. The update replaces the initial uncertainty around the reported $6.3 billion incident with a more detailed account of how transfers moved through Binance hot wallets and why suspending withdrawals did not immediately stop them. The Binance incident findings and response update is preliminary; the exchange says its investigation is ongoing and the findings will face independent review.

The change in account matters because the first reports described a potential security issue and an estimated impact, while Binance’s later report calls it a security incident and describes unauthorized transfers. The Associated Press report on Binance’s initial response said the company had not then explicitly confirmed funds were stolen. Binance’s Nov. 3 post says it will absorb the financial impact, had set aside more than the amount needed to cover the loss, and had replenished 98% of impacted token assets by Oct. 31. It says it is still purchasing the remaining, less liquid assets.

How did the transfers get past the withdrawal controls?

Binance says the attacker gained unauthorized access to an internal wallet-signing service and used it to initiate transactions outside the normal withdrawal process. Between 20:05 and 20:09 UTC on Oct. 29, five hot wallets sent 233.46 million XRP to an attacker-controlled address. Binance also reports transfers of about 970,500 SOL and 44.2 million OP, followed by 18,270 BTC.

The report says the attacker then used Ethereum’s EIP-7702 authorization mechanism to give a malicious smart contract partial execution rights over a Binance hot wallet. The mechanism allows an account to delegate some execution rights without revealing its private key. Binance says it found no evidence of a wallet private-key leak in its initial update; the later report describes unauthorized use of the signing service rather than a disclosed key exposure.

That distinction shapes the security problem. A private-key leak would point to one kind of compromise; Binance’s account instead centers on access to internal systems and on-chain permissions. The company says suspending withdrawals restricted further outflows but could not invalidate authorizations already established on-chain. Because the wallet used multi-party computation, Binance says there was no single key it could use to revoke them immediately. The final unauthorized transfer, 2,961.9 ETH, settled at 23:56 UTC; Binance says it cleared the delegation at 00:10 UTC on Oct. 30.

What does the recovery plan cover, and what remains uncertain?

Binance says about $2.85 billion has been frozen or intercepted, a figure it says remains subject to reconciliation and market-price changes. Freezing assets can limit what attackers move onward, but it does not by itself establish that all affected value is recoverable. The exchange’s stated plan is to cover losses itself, with 98% of impacted token assets already replenished as of Oct. 31 and less liquid assets still to be purchased.

Binance also says it rebuilt the affected wallet system and internal AI tool, replaced affected devices, revoked related credentials and tokens, and strengthened wallet-service controls. It has commissioned an independent cybersecurity review to validate its findings and recommend further measures. The company attributes the incident to North Korea based on information released by the FBI, but says the investigation and independent review are still underway.

The next measures of the response are therefore specific: the independent review’s findings, reconciliation of the $2.85 billion frozen or intercepted, completion of the remaining replenishment, and Binance’s promised updated proof of reserves. Those updates will show how closely the exchange’s initial accounting and explanation hold up under review.

Source material

• Binance incident findings and response update — binance.bh
• Associated Press report on Binance’s initial response — apnews.com