Binance Says It Replenished 98% of Assets Affected by Attack

Binance’s preliminary incident report says the exchange has replenished 98% of assets affected by an attack involving about $6.34 billion in digital assets, while $2.85 billion has been frozen or intercepted.

The report says unauthorized access to an internal wallet-signing service enabled transactions outside the normal withdrawal process. It also describes the attacker using Ethereum’s EIP-7702 authorization mechanism to gain partial execution access to hot wallets.

Binance said the attack involved a supply-chain compromise, social engineering, malware and misuse of an internal AI tool. The report says an attacker used a fake job interview to get an employee to download malicious code, then used compromised devices and the AI tool to reach wallet infrastructure.

The exchange said it had prepared compensation funds covering more than 100% of affected assets as of Nov. 3. It was still sourcing the remaining tokens, which have low liquidity. Binance said the frozen or intercepted total remains subject to further reconciliation and market-price changes.

Binance said it rebuilt the affected wallet systems and internal AI tools, replaced devices, revoked affected employee credentials and access tokens, and added wallet controls and AI anomaly detection. It plans to commission an independent cybersecurity review.