Binance’s 6.3 billion stolen incident: He Yi, Richard Teng and security chief comprehensive review
Author | Binance This content comes from Binance’s co-CEOs He Yi, Richard Teng, and Chief Security Officer Jimmy Xu’s public space on Binance in response to the major security incident that occurred on October 30. Binance said that attackers transferred approximately $6.34 billion in crypto assets by compromising the internal wallet signature service, bypassing the normal withdrawal process. At the time of sharing, approximately $2.85 billion in assets had been frozen or intercepted. Binance promised to bear the losses and said it had replenished approximately 98% of the affected token assets. There was no gap in user funds and withdrawal services had been restored. Jimmy said that the attacker was suspected of inducing an engineer to run malicious code on his work computer through fake recruitment and technical interviews, thereby gaining access to internal systems. The attacker also used the on-chain authorization mechanism to continue transferring funds after Binance suspended withdrawals. Binance believes the incident involved a hacking group with a state background and said its security team has blocked 57 cyberattacks suspected of being linked to North Korea in 2026. He Yi said that despite some internal concerns that disclosing technical details might bring additional risks, she still insisted on increasing the transparency of the incident. Binance plans to rebuild relevant wallet infrastructure, strengthen internal system isolation, and introduce independent security reviews. Talking about future development, He Yi believes that the encryption industry needs to pay more attention to real business value, and the integration of RWA, stock perpetual contracts and traditional finance and encryption markets will be important directions. The following amounts, attack attributions, asset recovery status and security measures are mainly derived from public statements by Binance management and do not yet represent the conclusions of independent investigations. The guest speeches do not represent Wu Shuo’s views and do not constitute any investment advice. Please strictly abide by local laws and regulations. US$6.34 billion in assets were affected, and Binance said it had frozen or blocked it
Author | Binance This content comes from Binance’s co-CEOs He Yi, Richard Teng, and Chief Security Officer Jimmy Xu’s public space on Binance in response to the major security incident that occurred on October 30. Binance said that attackers transferred approximately $6.34 billion in crypto assets by compromising the internal wallet signature service, bypassing the normal withdrawal process. At the time of sharing, approximately $2.85 billion in assets had been frozen or intercepted. Binance promised to bear the losses and said it had replenished approximately 98% of the affected token assets. There was no gap in user funds and withdrawal services had been restored. Jimmy said that the attacker was suspected of inducing an engineer to run malicious code on his work computer through fake recruitment and technical interviews, thereby gaining access to internal systems. The attacker also used the on-chain authorization mechanism to continue transferring funds after Binance suspended withdrawals. Binance believes the incident involved a hacking group with a state background and said its security team has blocked 57 cyberattacks suspected of being linked to North Korea in 2026. He Yi said that despite some internal concerns that disclosing technical details might bring additional risks, she still insisted on increasing the transparency of the incident. Binance plans to rebuild relevant wallet infrastructure, strengthen internal system isolation, and introduce independent security reviews. Talking about future development, He Yi believes that the encryption industry needs to pay more attention to real business value, and the integration of RWA, stock perpetual contracts and traditional finance and encryption markets will be important directions. The following amounts, attack attributions, asset recovery status and security measures are mainly derived from public statements by Binance management and do not yet represent the conclusions of independent investigations. The guest speeches do not represent Wu Shuo’s views and do not constitute any investment advice. Please strictly abide by local laws and regulations. US$6.34 billion in assets were affected, and Binance said it had frozen or blocked it