Binance Reveals Details of $6.34 Billion Hack

Cryptocurrency exchange Binance has disclosed details of the attack on October 29, 2026, which resulted in the theft of digital assets worth approximately $6.34 billion. Co-CEO Richard Teng stated that the perpetrators had been preparing the operation for several months, using malicious software and access to the exchange's internal infrastructure.

In a preliminary report published on November 3, Binance explained that the attack affected the transaction authorization system. The perpetrators used the Ethereum EIP-7702 mechanism, which allowed them to continue moving some assets even after regular withdrawals were suspended.

According to Teng, the company decided to disclose the details of the incident so that other participants in the cryptocurrency industry could take into account the identified risks when developing their own security systems.

How the Perpetrators Gained Access to Wallets

According to Binance's investigation, the preparation began in June 2026, when one of the engineers installed a modified software tool. The security system detected suspicious activity, after which the company replaced the device and updated the associated credentials. However, the attackers managed to obtain information about employees working with the wallet infrastructure.

In September, the perpetrators contacted another engineer, posing as representatives of a company conducting interviews. During the communication, the employee was offered to complete a test task that contained malicious code.

On October 20, the attackers used the compromised device and Binance's internal AI tool to expand access to other employees' computers. Later, they obtained credentials that allowed them to affect the transaction signing system.

On October 29, the perpetrators began withdrawing assets from the exchange's hot wallets across several blockchain networks. In Ethereum they additionally applied EIP-7702 – a mechanism that allows a regular wallet to temporarily use smart contract functionality.

According to the analytical company Blockaid, the attackers formed 50 signed permissions to delegate the execution of operations to a third-party contract. One of them was accepted by the network, after which the perpetrators gained the ability to move funds through a smart contract they controlled.

During one of the operations, approximately 167,464 ETH and separately about 1.6 billion USDT, as well as other tokens, were withdrawn from Binance's wallet.

Despite the suspension of withdrawals, the malicious permission continued to operate on the blockchain. To cancel it, Binance had to conduct additional operations, as the applied multi-party computation (MPC) system did not allow the permission to be immediately revoked with a single private key.

The delegation was finally canceled at 00:10 UTC on October 30, nearly 4 hours after it was set up.