Author | Binance

This content comes from Binance’s co-CEOs He Yi, Richard Teng, and Chief Security Officer Jimmy Xu’s public space on Binance in response to the major security incident that occurred on October 30. Binance said that attackers transferred approximately $6.34 billion in crypto assets by compromising the internal wallet signature service, bypassing the normal withdrawal process. At the time of sharing, approximately $2.85 billion in assets had been frozen or intercepted. Binance promised to bear the losses and said it had replenished approximately 98% of the affected token assets. There was no gap in user funds and withdrawal services had been restored.

Jimmy said that the attacker was suspected of inducing an engineer to run malicious code on his work computer through fake recruitment and technical interviews, thereby gaining access to internal systems. The attacker also used the on-chain authorization mechanism to continue transferring funds after Binance suspended withdrawals. Binance believes the incident involved a hacking group with a state background and said its security team has blocked 57 cyberattacks suspected of being linked to North Korea in 2026.

He Yi said that despite some internal concerns that disclosing technical details might bring additional risks, she still insisted on increasing the transparency of the incident. Binance plans to rebuild relevant wallet infrastructure, strengthen internal system isolation, and introduce independent security reviews. Talking about future development, He Yi believes that the encryption industry needs to pay more attention to real business value, and the integration of RWA, stock perpetual contracts and traditional finance and encryption markets will be important directions.

The following amounts, attack attributions, asset recovery status and security measures are mainly derived from public statements by Binance management and do not yet represent the conclusions of independent investigations.

The guest speeches do not represent Wu Shuo’s views and do not constitute any investment advice. Please strictly abide by local laws and regulations.

US$6.34 billion in assets were affected, and Binance said it had frozen or intercepted approximately US$2.85 billion.

Host Jessica: Can you tell us what exactly happened on October 30 and Binance’s current progress?

Richard Teng: This incident should not have happened and we take full responsibility for it.

On October 30, an attacker gained unauthorized access to the internal wallet signing service and initiated transactions outside of the normal withdrawal process. After the system detected abnormal large-amount fund transfers, we immediately launched an investigation, suspended withdrawals, and coordinated with our partners to freeze related assets.

The incident involved approximately $6.34 billion in digital assets. To date, approximately $2.85 billion has been frozen or intercepted, and work continues.

We have decided that Binance will bear all financial losses and will not let users bear the losses.

The rapid progress of this fund freeze cannot be achieved without the cooperation of stablecoin issuers, blockchain analysis companies and law enforcement agencies. The transparency of on-chain transactions allows all parties to track the flow of funds in real time and coordinate actions.

Jessica: He Yi, what was your reaction when you first learned about the attack?

He Yi: It was midnight in Abu Dhabi, and I was getting ready to go to bed. When I scrolled through X, I saw many people discussing whether Binance had been hacked. I immediately checked the internal work group and found that the team had already started investigating and handling it.

As a manager with a non-technical background, what I was most concerned about at the time was whether user assets were safe and how to explain the situation to the community.

Although the final amount of losses was not known initially, we quickly communicated with major shareholders and board leaders and decided to publicly commit to Binance to bear the losses to ensure that users would not suffer asset losses as a result.

The attack was still ongoing and we were constantly updating the situation. Industry partners such as Tether, Circle, USD1, and Aave, Arbitrum, Polygon, etc. quickly provided help, and some assets were frozen or blocked within hours.

This made me feel that although the encryption industry is usually fiercely competitive, all parties in the industry are still able to cooperate quickly when facing major security incidents.

Binance says user funds have not been damaged and 98% of affected token assets have been replenished

Jessica: What users are most concerned about is the safety of their funds. How does Binance prove that user assets are still protected? Is the suspension of withdrawals similar to FTX’s situation back then?

Richard Teng: Our position is very clear: there is no gap in user funds.

It is Binance’s own wallet and asset positions that are affected this time, not user funds. The vast majority of user assets are still stored in cold wallets, and we have found no evidence of wallet private key leaks or user data leakage.

We currently have more than the amount required to cover losses set aside, with approximately 98% of affected token assets already covered. The remaining approximately 2% is mainly less liquid assets, which will take more time to purchase and replenish, but which have also been funded.

Users can check relevant balances through Binance’s public Proof of Reserves.

As for the suspension of withdrawals, I don’t think it can be simply compared to FTX. FTX’s problem at the time was that there was a gap in customer funds, and Binance suspended withdrawals to control security incidents and protect existing funds.

We have resumed the withdrawal service after confirming that the relevant systems are safe. The suspension of withdrawals is a risk control measure and does not mean that the platform lacks solvency.

Fake recruitment breaks into engineers’ computers, and on-chain authorization allows the attack to continue after withdrawals are suspended

Jessica: Binance has a large security team and many years of security investment. How do attackers break through the defense line?

Jimmy Xu: This was a well-targeted attack that lasted for several months, not just any random online scam.

In September this year, a software engineer received contact from the so-called project leader through a formal recruitment platform. The attacker knew he had a background in Binance, so the contact was clearly targeted.

Subsequently, engineers participated in two rounds of interviews. The first round is a video communication with a fake HR person, who also provides a social account containing personal photos and videos to build trust. The second round was conducted via social software, with another attacker impersonating the CEO of a fictitious company.

Towards the end of the interview, the engineer was asked to download a coding assignment on his work computer. In fact, this code repository contained malicious programs that were executed during the installation and configuration process.

The malicious program executes instructions by replacing components of normal development tools and communicates with an external server controlled by the attacker. We believe zero-day malware was used, which was not detected by third-party endpoint security products at the time. Attackers also took steps to hide traces of their activities, making investigation more difficult.

So far this year, our security teams have identified and blocked 57 suspected North Korea-related cyberattacks, including fake job recruitment, malware disguised as development tools, software packages and browser extensions with malicious code, and fake video conferencing applications.

These attacks demonstrate that social engineering attacks on employees have become a significant risk to the industry.

Jessica: Why were attackers still able to continue transferring assets after Binance suspended withdrawals?

Jimmy Xu: This is one of the most important technical lessons from this incident.

The attacker exploited an on-chain transaction authorization mechanism. Suspending withdrawals can only prevent Binance's own withdrawal infrastructure from continuing to process new requests, but the malicious authorization previously established by the attacker already exists on the chain and is no longer dependent on Binance's withdrawal system.

Therefore, while suspending withdrawals is necessary, it is not enough to completely prevent the attack.

We must revoke these authorizations through additional on-chain transactions. However, the affected hot wallet uses a multi-party computation (MPC) architecture and does not have a complete private key that can be directly used to immediately revoke authorization.

Security teams had to design and execute specialized revocation procedures in a very short period of time, which is why stopping funds from continuing to leave took hours, not minutes.

We hope to make this technical issue public so that platforms using similar wallet architectures can understand the related risks in advance.

AI enhances attack and defense at the same time, He Yi insists on disclosing details of security incidents

Jessica: What role did AI play in this attack and security defense?

Richard Teng: AI is both an offensive tool and a defensive tool.

AI is changing the cost structure of cyberattacks, allowing attackers to launch sophisticated attacks faster and at greater scale. What once required a dedicated team is now possible through automated tools, and social engineering attacks are becoming more realistic.

But the same technology can also help security teams identify anomalous behavior, track funds and improve response efficiency.

Therefore, we are increasing our investment in AI anomaly detection, behavioral monitoring and endpoint security, and working with AI enterprises and cybersecurity companies.

No organization can guarantee 100% security, but we must continue to improve our defense systems.

Jessica: He Yi, why do you insist on disclosing technical information?

He Yi: In fact, some internal senior managers and legal teams have suggested not to disclose too many technical details in public reports, but I have not accepted this suggestion.

I believe that an important reason why Binance has been able to gain the trust of the community in the past ten years is its willingness to face problems openly.

When mistakes happen, we should admit them and improve them rather than try to hide them. There is value in disclosing more information if it helps other platforms understand attack methods and improve security.

I run the HR team and have come across similar cases of questionable hiring. For example, the person who appeared during the interview was not the same person who came to the office later; there were also abnormalities in the candidate's identity information and the network environment. After further verification, the person suddenly lost contact.

These situations indicate that attackers may study corporate recruitment and internal management processes for a long time and use identity disguise to look for opportunities.

AI can be both a weapon for attackers and a shield for defenders. We need to continue to improve our security capabilities and share our experience with the industry.

Rebuilding wallet and internal systems, introducing independent security review

Jessica: What corrective measures has Binance taken? How to prevent similar incidents from happening again?

Jimmy Xu: As of November 3, we have completed a number of emergency rectifications.

First, rebuild the affected wallet system and internal AI tools in the new environment and tighten access control. At the same time, the affected employees' devices were replaced, relevant credentials and access tokens were revoked, and enhanced security scans were performed on employee devices.

We have also upgraded AI-based abnormal behavior detection and risk control measures for wallet services, and continue to track relevant assets with law enforcement agencies, on-chain analytics companies, and industry partners.

The longer-term focus is on tightening system isolation, including distinguishing between internal and external network traffic, isolating work content from sensitive data, and tightening file storage and network access controls on corporate devices.

The core principle is that even if a single employee device is compromised, it should not escalate into a systemic security incident.

Next there are three main directions.

First, external security experts are brought in to conduct an independent review to verify the incident investigation results and make further recommendations for improvements. We can't rely solely on our internal teams to judge for themselves whether a system is secure.

Second, increase investment in AI security, focusing on strengthening threat detection, terminal protection, development environment security and abnormal behavior monitoring. This incident illustrates that internal AI tools and development environments must also be considered critical infrastructure.

Third, strengthen industry cooperation. We are promoting the establishment of a security research fund and plan to work with AI companies, security agencies, and other industry players to study AI security threats in the blockchain environment.

In addition, we will re-examine the wallet signature policy, hot wallet control mechanism and incident response process to shorten the time required to detect, contain and deal with attacks in the future.

Risk warning

According to the latest Yinfa [2026] No. 42 document issued by eight departments including the People's Bank of China, the content of this platform is only used for sharing technology and information in the blockchain industry. It does not constitute any investment advice, and does not promote or endorse any business or investment behavior. Readers are requested to strictly abide by the laws and regulations of their region and beware of investment risks and fraud. There are currently a large number of fraudulent and counterfeit accounts, so please be vigilant and screen them carefully. All content on this platform is prohibited from reprinting, copying or commercial use without permission.

Beijing Blue Seahorse Cultural Communication Co., Ltd. All rights reserved. Beijing ICP No. 2023026470