Binance looks back on the progress of its hack - What happened?

Home » Crypto News » Exchange News » Binance looks back on the progress of its hack - What happened?

https://cryptoast.fr/binance-revient-sur-deroulement-piratage-que-sest-il-passe/

It's hard not to be aware: the leading cryptocurrency market platform Binance suffered a hack worth an astronomical amount estimated at $6.34 billion on October 29, leaving the crypto ecosystem in shock.

A hack quickly attributed to North Korea by cybersecurity specialists - and finally confirmed by the FBI according to information from Binance - equivalent to 19% of its GDP. Not enough to destabilize Kim Jong Un's sister, Kim Yo Jong, who did not fail to deny these accusations by affirming that it is a set-up by Washington.

🔍 Discover our top 10 best cryptocurrency exchange platforms

Meanwhile, the Binance platform has tried to manage the situation in the best possible way, firstly ensuring that its users do not suffer the consequences of this “serious and very sophisticated security incident which should never have happened”, as it recalls in its initial report published on the X network.

Our first responsibility is to protect users. Binance will absorb the financial impact of stolen funds, not our users. We have already set aside over 100% of the funds needed to cover the loss. As of October 31, 2026, 98% of affected token assets have been replenished, which is verifiable on our proof of reserves page. We are in the process of purchasing the remaining, more illiquid assets.

According to the first elements published by Binance, its hack involved a rapid and coordinated operation on several separate blockchains, taking advantage of the exploitation of “unauthorized access to an internal wallet signing service in order to initiate transactions outside of the normal withdrawal process”.

A flaw which will allow the attacker to take control of five hot wallets (connected to the Internet) and transfer 233.46 million XRP, 970,500 SOL and 44.2 million OP to addresses controlled by the attacker, all in just a few minutes.

Operations which will quickly trigger an internal alert due to the involvement of large volumes. And while an investigation was immediately opened, an additional 18,270 BTC will leave the exchange in turn.

👉 Ethereum: new proposal to deactivate EIP-7702, exploited during the Binance hack

The attacker then used the signature service to exploit Ethereum's EIP-7702 authorization mechanism. EIP-7702 allows an account to delegate certain execution rights to a smart contract without exposing the private key. In this case, the attacker used this mechanism to give a smart contract he controlled partial execution rights on a Binance hot wallet.

Machine-translated from French