Binance said about $6.34 billion in digital assets were affected by an attack on 29 October 2026. About $2.85 billion has been frozen or intercepted, it said, and it will cover the loss. Binance described a multi-stage campaign: a tampered Homebrew install on one engineer's machine in June, a fake job interview with another engineer in September, and an internal AI tool used as a stepping stone on 20 October. The FBI's latest information points to North Korea, Binance said.
The attackers then used Ethereum's EIP-7702 feature to give their own smart contract partial control of a Binance hot wallet. Binance said these permissions sat on the blockchain, so halting withdrawals did not end them. Its wallet had no single key to cancel them, so it built a special procedure. BlockAid's chief executive told Dark Reading the permission names no amount or destination, so withdrawal controls never see it. Binance's investigation continues, and some details stay private.
Dark Reading quoted experts who said Binance seemingly lacked a tested kill switch; Binance did not say that. Buyers and builders can ask who can cancel a standing on-chain permission, and how fast. They can also ask how far an internal AI tool's access reaches, and how developer machines and installs are checked.