Binance Chief Security Officer Jimmy Su: External Experts Are Being Hired to Independently Review the October 29 Incident
Binance Chief Security Officer Jimmy Su said during Binance’s X Space fireside chat on November 9 that the company is hiring external security experts to carry out a comprehensive independent review of the security incident that occurred on October 29, in order to verify the conclusions of the internal investigation and propose improvement suggestions. He also said that Binance is working with leading AI companies, security companies and other partners to set up a security research fund, focusing on studying AI-related security threats in the blockchain field, and that future internal AI tools and development environments will be managed according to critical infrastructure standards.
Regarding the incident, Jimmy Su explained that the transaction authorization used by the attacker existed on-chain and did not go through Binance’s withdrawal system, so suspending withdrawals could not prevent funds from flowing out; an on-chain transaction had to be issued separately to revoke the authorization. Binance’s hot wallets use multi-party computation (MPC) technology and do not have a single private key whose authorization can be revoked immediately, so the team could only temporarily devise a revocation process, and it took several hours to bring the situation under control. He also said that the attack used zero-day malware, and that third-party endpoint protection software at the time did not recognize the software.
Binance previously released a preliminary investigation report on November 3, saying that the incident affected about $6.34 billion in assets, about $2.85 billion of which had been frozen or intercepted, and that it planned to conduct an independent review and set up related funds. The Federal Bureau of Investigation has attributed the incident to North Korea.
Original source:
Title: Binance Chief Security Officer: Currently Establishing a Security Research Fund, Focusing on Blockchain and AI-Related Security Threats Publisher: Odaily Date of publication: 2026-11-09 URL: https://www.odaily.news/en/newsflash/532457 Source nature: media report Verification status: full text actually read this time, verification date 2026-11-09, no access restrictions Supporting content: supports Jimmy Su’s statements in the X Space about the independent review, security research fund, on-chain authorization, MPC hot wallet revocation process and AI tool management; does not prove that the fund has been formally established or that the review has been completed
ABAB AI Insight
Jimmy Su has served as Binance’s Chief Security Officer since 2020, and previously led security research and engineering at FireEye and JD.com. The October 29 incident is the largest security incident Binance has disclosed to date, and the preliminary report showed that the attacker entered the wallet signing service through months of activity, including fake recruiting and misuse of internal AI tools, and continuously operated on-chain by using mechanisms such as EIP-7702. This X Space was the first time within 11 days after the incident that company executives systematically explained the technical details and follow-up arrangements to the public.
The arrangements for the independent review and the research fund correspond to two specific gaps exposed by the incident: first, the development environment and AI tools were used as a lateral movement path; second, the MPC architecture of the hot wallets lacked a preset process for emergency revocation. Binance’s November 3 report had already mentioned commissioning an independent organization to recheck and study AI-related threats; this statement makes managing AI tools according to critical infrastructure standards a follow-up operational requirement, rather than leaving it only at the level of investigation conclusions.
Compared with the Bybit incident in February 2025, the Bybit incident was also attributed to a North Korea-related organization and likewise involved continued transfers after authorization mechanisms were abused. The difference is that after the Bybit incident, the industry placed more emphasis on hot-cold separation and withdrawal circuit breakers, whereas Binance this time emphasized that on-chain authorization cannot be blocked by suspending the platform layer, and that revocation of MPC hot wallets requires building a process on site. This difference turns “suspending withdrawals” from an effective control measure into only a measure that can limit subsequent new requests.
Jimmy Su’s explanation clearly sets the control time at “hours” rather than “minutes,” directly corresponding to the technical constraint that there is no single private key that can be revoked immediately under the MPC architecture. If the independent review confirms the internal conclusions, it could push Binance to place AI tools and development environments under the same level of control as hot wallets, and could also affect the emergency response process design of other exchanges using MPC hot wallets. Observable indicators include whether the independent review report publicly discloses specific improvement items, and whether the security research fund clearly states its funding sources and research scope in subsequent announcements.
ABAB News · Law of Cognition
Once on-chain authorization takes effect, suspending withdrawals at the platform layer cannot interrupt the ongoing transfer of already authorized funds; a separate on-chain transaction must be issued to revoke it.
When an MPC hot wallet has no single private key that can revoke authorization immediately, emergency response requires building a process on site, so the control time is extended to hours.