Binance says attackers used a fake recruitment process to gain access to its transaction signing system. About $2.85 billion in assets has been frozen or intercepted, and Binance says it will cover the losses from its own funds.
Original reporting by Adam Ujazdowski, published on 3 November 2026 in the Polish edition.
The attack took place on 29 October 2026. In a preliminary report published on 3 November, Binance said it had replenished 98% of the affected assets by 31 October. The exchange said users could verify reserves through its Proof of Reserves disclosure. It said it had set aside more than enough funds to cover the losses and was still buying the remaining less liquid tokens.
Frozen or intercepted assets account for about 45% of the estimated value of the theft. Binance cautioned that the amount could change as transactions are reconciled and token prices move. Freezing restricts further transfers, while recovering the assets requires separate action.
Fake job interviews and malicious code
Binance traced the first signs of the attack to June. A wallet engineer downloaded a tampered Homebrew installer while looking for an AI coding tool. The security team detected suspicious activity, replaced the computer and reset access credentials. By then, the attackers had identified the engineer’s responsibilities and colleagues.
In September, the attackers contacted a second engineer through a job listings site. After two interviews with purported company representatives, they asked the engineer to download a recruitment assignment to a work computer. When the project ran, malicious code replaced part of a development tool and connected to the attackers’ server. The computer’s security software did not detect the infection at the time.
On 20 October, the attackers used the compromised computer and an internal Binance AI tool to access two more employees’ environments. They found a credential that allowed them to deploy software on the exchange’s infrastructure. Nine days later, they used it to launch a script that let them order transfers outside the standard withdrawal process.
Withdrawal suspension failed to stop every transfer
Between 20:05 and 20:09 UTC on 29 October, the attackers moved 233.46 million XRP from five internet-connected Binance wallets to an address they controlled. The exchange also recorded unauthorised transfers of about 970,500 SOL, 44.2 million OP and 18,270 BTC. After detecting the large transfers, Binance began investigating and suspended withdrawals.
On Ethereum, the attackers used EIP-7702, which allows an account to authorise a smart contract to act on its behalf. They used Binance’s signing system to grant that authority to a contract they controlled. The authorisation was recorded on the Ethereum blockchain and remained valid after the exchange suspended withdrawals.
Revoking it required a separate Ethereum transaction. The wallet used multi-party computation (MPC), which requires several system components to cooperate to produce a signature, and Binance said it had to develop a dedicated procedure. The last unauthorised transfer, of 2,961.9 ETH, was confirmed at 23:56 UTC. Binance revoked the smart contract’s authority at 00:10 UTC on 30 October.
FBI attributes the theft to TraderTraitor
The FBI attributed the theft to the North Korean group TraderTraitor. It published addresses used to move stolen funds and urged companies in the industry to block related transactions. North Korean authorities denied involvement.
Binance said it had rebuilt its wallet system in a new environment, redesigned its internal AI tool, changed the rules for accessing it and revoked credentials linked to the compromised computers. The exchange said external experts would review the attack and assess which safeguards need further changes.
Sources: Binance, FBI, Associated Press and Ethereum EIP-7702 documentation.
