Binance Publishes Preliminary Report on Hack Incident: 98% of Affected Assets Replenished, $285 Million in Assets Frozen

Odaily reports: Binance has released a preliminary report on the security incident, disclosing that the attack involved approximately $6.34 billion in digital assets. As of November 3, Binance has prepared over 100% of compensation funds for affected assets and has replenished 98% of the affected tokens, with the remaining less-liquid assets currently being procured. Currently, approximately $2.85 billion in assets have been frozen or intercepted, though the relevant amounts still require further verification and are subject to market price fluctuations.

The report discloses that the attackers exploited unauthorized access to an internal wallet signing service to initiate transactions outside the normal withdrawal process, and leveraged Ethereum's EIP-7702 authorization mechanism to gain partial execution permissions on hot wallets. During the attack, the attackers transferred out 233.46 million XRP, approximately 970,500 SOL, 44.2 million OP, and 18,270 BTC and other assets through Binance hot wallets, with the final unauthorized transfer of 2,961.9 ETH completing on-chain confirmation at 23:56 UTC on October 29.

Binance stated that the attack involved multiple vectors including supply chain attacks, social engineering, malware, exploitation of internal AI tools, and abuse of transaction authorization mechanisms. The attackers previously used fake recruitment interviews to trick employees into downloading malicious code, and leveraged infected devices and internal AI tools to further gain access to wallet infrastructure.

Binance has now rebuilt the affected wallet systems and internal AI tools, replaced relevant devices, revoked credentials and access tokens of affected employees, and strengthened risk controls for wallet services and AI behavioral anomaly detection. Binance will also engage an independent cybersecurity firm to review the incident and plans to establish a security research fund to advance AI and blockchain security research. The report also notes that the investigation is still ongoing, and some technical details will not be disclosed at this time.