Binance Initial Findings Trace $6.34B Theft From Homebrew to EIP-7702
By Crypto Wire
November 4, 2026
Desk of the Day — Rug Room
Binance published its Initial Findings and Response Update on the Oct. 29, 2026 security incident, and the forensic path is the story — not another reserves-percentage reprint. The exchange puts about $6.34 billion of digital assets as impacted, says about $2.85 billion has been frozen or intercepted subject to reconciliation and price moves, and claims 98% of impacted token assets were replenished as of Oct. 31 and are verifiable on its Proof of Reserves page. This Rug Room chapter links the prior phase-two restore tape (15534) and the FBI attribution LN (11825) as backdrop while the new primary is the attack path itself.
Binance frames the campaign as months long, not a single overnight breach. In June 2026, a Wallet DevOps engineer labeled Engineer A downloaded a tampered Homebrew installation while searching for a popular AI coding tool. Security spotted the anomaly, replaced the device, and rotated related credentials — but Binance says the engineer’s role and colleagues on the wallet infrastructure team were already exposed to the attacker. Throughout 2026, the exchange says its security team detected and prevented 57 suspected North Korea-linked cyber threat cases spanning fake interviews, malware disguised as developer tools, compromised packages and browser extensions, fake video-conferencing apps, and credential-theft social engineering.
The second foothold landed in September 2026. Software Engineer B, whose job-platform profile referenced Binance experience, was contacted by someone posing as a Project Director. A first-round live video interview with a purported HR representative came first — complete with a social account stacked with personal photos and videos meant to build trust. A second round in a social chat app, with someone claiming to be CEO of a fictitious company, closed by instructing Engineer B to download an “assignment” repository onto a work computer. Binance says that repository was malware that replaced a legitimate development-tool component, talked to an attacker-controlled server, and used zero-day evasion that endpoint tools did not catch at the time.
On Oct. 20, Binance says the attacker used Engineer B’s compromised machine and an internal AI tool to reach Engineer A and a third wallet engineer, then found a container-deployment token on Engineer A’s machine. On Oct. 29, between about 17:15 and 19:56 UTC, the attacker used stolen credentials to log onto the third engineer’s computer, deploy a container, and run a malicious script that opened unauthorized access to an internal wallet signing service — outside the normal withdrawal process.
The drain window is now named in UTC minutes. Between 20:05 and 20:09 UTC, five Binance hot wallets sent 233.46 million XRP to an attacker-controlled address. Solana and Optimism hot wallets sent about 970,500 SOL and 44.2 million OP. A hot wallet then sent 18,270 BTC. The attacker next used the signing service against Ethereum’s EIP-7702 authorization mechanism — submitting 50 signing transactions to manipulate the account nonce and establish malicious delegation authorizations that gave an attacker-controlled smart contract partial execution rights over a Binance hot wallet. Suspending withdrawals alone could not kill those on-chain authorizations; because the hot wallet uses multi-party computation, there was no single private key for an immediate revoke. Binance says it built a specialized revocation procedure. The final unauthorized transfer of 2,961.9 ETH finalized at 23:56 UTC; at 00:10 UTC on Oct. 30, Binance cleared the EIP-7702 delegation from the Binance14 hot wallet by authorizing to the zero address.
Cleanup claims sit beside the path. Binance says it will absorb the financial impact rather than pass losses to users, has set aside more than 100% of funds required to cover the loss, rebuilt the affected wallet system and internal AI tool, replaced devices, decommissioned related credentials and tokens, scanned employee devices, and expanded AI-based behavioral anomaly detection. An independent review and a security research fund with AI and industry partners are still framed as forthcoming. Desk readers should treat the 98% Oct. 31 replenishment claim as the company’s own PoR-linked statement — earlier recovery updates had printed about 90% on Oct. 31 and about 95% into early November, so reconcile against the live Proof of Reserves page rather than stacking percentages as a single tape print.
For collectors and NFT desks that route fiat or stables through Binance, the practical forensic beat is custody hygiene upstream of bids: developer-machine compromise and internal signing abuse can move hot-wallet balances before a marketplace floor ever ticks. The FBI’s earlier TraderTraitor / DPRK attribution still stands as the government framing; Binance’s initial findings now supply the June→September→October ladder that connects that attribution to named asset legs and the EIP-7702 linger problem.
What to watch on-chain next: Confirm the live Proof of Reserves page still shows the claimed 98% replenishment versus residual illiquid buys; watch for any new freeze climb past the ~$2.85 billion intercepted print; and wait for remaining Update #6 withdrawEnable flips, the Nov. 4 broader PoR/zk window if it posts, or an independent review that names what Binance still withholds from the attack path.
Bottom line: Binance’s initial findings finally name the exploit path — June Homebrew exposure, September fake-interview malware, October internal AI hop into a signing service, and an EIP-7702 linger that outlived the withdrawal halt — around a ~$6.34 billion impact print with ~$2.85 billion frozen and a company claim of 98% replenishment as of Oct. 31.
Disclaimer: This article is provided for informational and educational purposes only. It does not constitute financial, investment, legal, or trading advice. The NFT market is highly volatile, and past performance is not indicative of future results. Readers should conduct their own research and consult qualified professionals before making any decisions related to digital assets. The cover image for this article may have been created using artificial intelligence (AI).
