Binance details $6.34 billion wallet-signing incident

Binance said on Nov. 3 that attackers used an internal wallet-signing service to move about $6.34 billion in digital assets across several networks, making the incident a test of how quickly an exchange can stop transactions already authorized on-chain. In its initial findings and response update, Binance said roughly $2.85 billion had been frozen or intercepted and that it would cover the financial impact of stolen funds.

The exchange’s report says the attacker gained access to its signing service and used it to initiate transactions outside the normal withdrawal process. Binance hot wallets sent XRP, SOL, OP and BTC to attacker-controlled addresses. A hot wallet holds crypto connected to online systems so an exchange can process transactions.

How did the attacker keep moving assets?

Binance says the attacker used Ethereum’s EIP-7702 authorization mechanism to give a smart contract partial execution rights over a hot wallet. EIP-7702 lets an account delegate certain actions to a contract without revealing its private key. In this case, Binance says, the attacker used the mechanism to move assets without following the exchange’s usual withdrawal route.

That distinction helps explain why suspending withdrawals did not end the outflows. The existing authorizations lived on the blockchain and could operate independently of Binance’s normal withdrawal systems. Binance says its hot wallet used multi-party computation, or MPC, which splits signing authority across multiple participants rather than relying on one private key. It had to develop a separate procedure to revoke the unauthorized on-chain permissions.

What did Binance do to contain the incident?

Binance says it suspended withdrawals, coordinated with blockchain partners to freeze tokens, and worked to revoke the unauthorized permissions. The last unauthorized transfer it reported was 2,961.9 ETH, which finalized on-chain at 23:56 UTC on Oct. 29. Binance said it cleared the malicious delegation code at 00:10 UTC the next day.

In its report on Binance’s initial response, The Associated Press said the exchange had temporarily suspended both deposits and withdrawals while conducting security checks. Binance’s later update put the frozen or intercepted amount at about $2.85 billion, subject to reconciliation and market-price changes.

Who bears the reported loss?

Binance says it will absorb the financial impact and had set aside more than the amount needed to cover it. The exchange reported that 98% of impacted token assets had been replenished as of Oct. 31, with purchases of the remaining, less liquid assets still under way. It also said it found no evidence that wallet private keys were compromised.

The investigation is continuing, and Binance said its findings will receive independent review. The reported figures describe assets impacted and funds frozen or intercepted; they do not mean that the full $6.34 billion remained unrecovered.

Sources and documents

• initial findings and response update — binance.bh
• report on Binance’s initial response — apnews.com