Editorial analysis · Primary sources

Binance traces signing-service compromise and an on-chain containment gap

Binance’s 3 November initial findings trace the 29 October theft through compromised developer endpoints, internal AI tooling and a wallet-signing service. The company says 98% of affected token assets had been replenished by 31 October; the FBI separately attributes the operation to TraderTraitor.

Event: 2026-10-29 · Disclosure: 2026-10-30
Updated: 2026-11-04T07:35:00.000Z · Confidence: high

Incident, disclosure and update

The incident occurred on 29 October 2026 and Binance disclosed it on 30 October.[1] Its initial findings, published 3 November, describe a campaign beginning with a tampered developer-tool installation in June and a malicious recruitment assignment in September. Binance says the attackers later used compromised endpoints, internal AI tooling and a deployment token to reach wallet-signing operations.[3] This is a material update to the earlier recovery report, not a new incident.

Transaction path and containment

Binance says unauthorized access to an internal signing service bypassed the normal withdrawal process. The attacker established Ethereum EIP-7702 delegation authorizations, so suspending withdrawals did not revoke permissions already recorded on-chain. Because the affected hot wallet used multi-party computation, no single private key could immediately clear them. Binance reports that the final unauthorized transfer settled at 23:56 UTC and the delegation was cleared at 00:10 UTC on 30 October.[3]

Recovery, attribution and uncertainty

Binance puts impacted assets at about USD 6.34 billion and says about USD 2.85 billion had been frozen or intercepted, subject to reconciliation and market volatility. It says 98% of affected token assets had been replenished by 31 October, with remaining illiquid assets still being purchased.[3] The FBI separately attributes the theft to North Korea’s TraderTraitor activity and says stolen assets were being converted mainly into Ether before further laundering.[4] That attribution is the FBI’s assessment; Binance’s independent review remains pending.

CISO priorities

For organizations operating signing, payment or deployment services, the mission risk spans developer workstations, AI assistants, CI/CD tokens and transaction authorization as one trust chain. Validate that emergency shutdown procedures revoke off-platform and on-chain authorities, not only application workflows. Inventory deployable credentials on endpoints, require short-lived scoped tokens and independent approval for signing-policy changes, and test recovery against pending transactions and delegated permissions. Preserve endpoint, AI-tool, container, signing and ledger telemetry under a single incident timeline.

Sources

Francisco Javier Jurado Alonso