On October 29, Binance discovered that attackers had compromised its wallet signing infrastructure and stolen approximately $6.3 billion in cryptocurrency. The incident revealed a crucial vulnerability: the exchange's emergency controls could shut down its own systems but could not prevent attackers from moving assets through permissions they had already established directly on the blockchain.
The attack began months earlier. According to Binance's incident report from November 3, an engineer downloaded a tampered installation package for an AI coding tool in June. Although the exchange detected and replaced the compromised device, attackers had already gathered intelligence about employees and infrastructure. In September, another engineer was targeted through a fictitious recruitment process involving interviews and a malicious coding assignment.
By October 20, attackers used compromised employee systems and internal AI tooling to access additional machines and obtain credentials for Binance's wallet signing infrastructure. Between 20:05 and 20:09 UTC on October 29, hot wallets transferred approximately 223.46 million XRP, 970,500 SOL, and 44.2 million OP to attacker-controlled addresses, with Chainalysis estimating total theft at approximately $6.4 billion.
Blockchain Permissions Beyond Binance's Control
On Ethereum, attackers exploited EIP-7702, a mechanism allowing externally owned accounts to delegate execution to smart-contract code. Using Binance's compromised signing infrastructure, attackers granted malicious code execution rights over an Ethereum hot wallet through 50 signed transactions that manipulated the account's nonce and established the delegation.
The critical problem emerged after Binance suspended withdrawals and shut down its hot-wallet services. Those permissions remained valid on-chain despite the suspension. Binance could stop its own systems from processing transactions, but it could not simply switch off the authority attackers had already established on Ethereum.
Binance's hot wallet used multi-party computation (MPC), which distributes cryptographic signature production across multiple participants rather than relying on a single private key. This architecture reduced certain risks but also meant no single private key was available to revoke the malicious delegation immediately. Binance's engineers had to develop a specialized revocation procedure while the incident was unfolding, delaying containment efforts.
Assets Continued Moving During Response
An additional complication emerged: Binance's compromised wallet continued receiving deposited funds. According to analysis from Four Pillars dated November 4, Binance's deposit-consolidation system kept collecting funds into the compromised Ethereum wallet, allowing attackers to sweep newly arriving assets. Nexus Mutual's reconstruction showed an attacker sweeping 200 million USDT that another Binance-labeled wallet had deposited approximately 72 seconds earlier.
This revealed a separate containment problem. While Binance worked to revoke the attacker's authority, operational systems continued directing funds toward the compromised address. Interrupting these internal asset flows required additional controls and confirmation beyond the initial emergency procedures.
The Limits of Emergency Controls
Binance suspended withdrawals at approximately 20:30 UTC on October 29. The final reported unauthorized Ethereum transfer, involving 2,961.9 ETH, was confirmed on-chain at 23:56 UTC. Binance cleared the malicious EIP-7702 delegation with a new authorization to the zero address at 00:10 UTC on October 30.
Binance subsequently coordinated freezes of stolen funds and began replenishing affected holdings, reporting approximately 98% replenishment by November 4. However, the exchange did not establish a reconciled post-suspension loss figure, leaving unclear how many assets moved after emergency controls took effect.
The distinction matters because suspending withdrawals stops an exchange's own software but does nothing about permissions already written to the blockchain. An attacker with valid on-chain permissions can continue moving assets even when the exchange's systems are offline.
Comparable Vulnerability at Bybit
A related incident at Bybit in February 2025 exposed comparable risks. Attackers stole approximately $1.5 billion after compromising the environment associated with Bybit's Safe{Wallet} approval process. According to Bybit's disclosure, malicious changes deceived signers into approving unauthorized transactions. Both incidents demonstrated how much depends on the integrity of transaction authority and that multiple signatures offer limited protection when signers are misled about what they are approving.
Binance deserves credit for publishing response details, coordinating substantial asset freezes, and committing resources to replenish holdings. These measures helped absorb financial damage. However, they also highlighted why reimbursement and actual containment should not be confused. An effective kill switch must provide defenders with genuine control over compromised permissions, not merely time to locate where control has been lost.
