Binance has disclosed details of a major security incident on October 29, 2026, in which approximately $6.34 billion in digital assets were impacted. The cryptocurrency exchange said attackers gained unauthorised access to its internal wallet signing infrastructure and used it to transfer assets outside the normal withdrawal process.

In its initial incident report released on November 3, Binance said around $2.85 billion in digital assets had been frozen or intercepted.

The exchange also said it would absorb the financial impact of the stolen funds and had set aside more than 100% of the amount required to cover the loss.

The investigation points to a sophisticated, multi-stage cyberattack involving fake recruitment interviews, malicious software, compromised employee devices and an internal AI tool.

Here is how the attack unfolded, how Binance contained it and what cryptocurrency users should know.

Attackers exploited unauthorised access to an internal wallet signing service to initiate cryptocurrency transfers without following Binance's normal withdrawal process.

The final unauthorised ETH transfer was completed at 23:56 UTC on October 29. Binance said no further unauthorised transfers were observed after it cleared the malicious authorisation on October 30.

Binance's investigation identified a multi-stage operation targeting employees associated with its wallet infrastructure.

The sequence began in June 2026, when an engineer downloaded a tampered Homebrew installation while attempting to install an AI coding tool. Although Binance detected the anomaly, replaced the device and rotated related credentials, the attackers had already gained information about the engineer and his colleagues.

In September, another software engineer was approached through a job-hunting platform by individuals posing as representatives of a fictitious company.

Source link