Cryptocurrency exchange Binance released a preliminary investigation report on November 3, 2026, clarifying how hackers executed the drain of approximately $6.34 billion in digital assets on October 29, 2026. Rather than exploiting a single smart contract vulnerability, the incident was a months-long cyber espionage campaign utilizing sophisticated techniques that combined supply chain attacks, direct recruitment social engineering, and the compromise of an internal artificial intelligence tool.
A Preparation Campaign Dating Back to June 2026
According to details shared by the exchange, the attack traced its origins back to June 2026 when an engineer on the wallet infrastructure team downloaded a malicious Homebrew installer via a fraudulent search engine ad. While the exchange’s security team detected the anomaly, replaced the device, and revoked credentials, the engineer’s job role and connection to wallet infrastructure were compromised to the adversary.
By September 2026, the hackers approached another software engineer through a recruitment platform, posing as a project director. The attacker established trust through live video calls and shared social media profiles displaying everyday personal photos before sending a technical assignment containing hidden malware to the engineer’s workstation. This malware replaced the executable file of the pyenv version manager tool to maintain remote access undetected by local monitoring systems.
Springboard from an Internal AI Tool and EIP-7702 Authorizations
The turning point of the attack occurred on October 20, 2026, when the hackers leveraged the second engineer’s compromised workstation to manipulate an internal Binance AI tool. Through this tool, the attacker hijacked the accounts of both the original wallet infrastructure engineer and a third engineer, subsequently gathering system container deployment tokens.
On the late afternoon of October 29, 2026, the hackers logged into the third engineer’s computer, deployed a malicious container, and triggered exploit code targeting the wallet signing service. A particularly critical factor was that the attacker broadcast 50 signed transactions to set up authorizations under Ethereum’s EIP-7702 standard. This mechanism granted partial execution authority over the hot wallet to the attacker’s smart contract. Because these authorizations existed independently on-chain, the exchange’s decision to halt withdrawal gateways could not immediately stop the ongoing outflows, mirroring the complex dynamics noted in the initial reporting on EIP-7702 by industry analysts.
Containment Efforts and Infrastructure Control Challenges
Binance stated that it froze or coordinated the stoppage of roughly $2.85 billion in assets. As of October 31, 2026, the exchange had replenished 98% of the affected tokens in its reserve fund and committed to absorbing the entirety of the financial losses. Because the hot wallet operates on an MPC multi-party computation architecture, technical teams were unable to use a single private key to immediately revoke the malicious authorizations, prolonging containment efforts until the early hours of October 30, 2026.
The incident unfolds as North Korea denies allegations from the FBI alleging that the TraderTraitor group was behind the attack. Previously, the exchange also experienced net outflows of nearly $6 billion when it reopened withdrawals. The preliminary report demonstrates that security challenges for large-scale digital asset institutions are no longer confined to smart contract code audits, but now depend heavily on privilege management for internal AI tools and newly emerging on-chain account abstraction mechanisms.