Statements

Early signs on Ethereum pointed to phishing of the authorizations, which could explain Ethereum but none of the other chains.

Binance says it found no evidence that a private key leaked, while investigators say Binance's signing system signed for the attacker, and the two statements can both be true.

At Binance the delegation stayed for 3 hours 46 minutes after the sweep and later deposits were swept again

Nobody outside Binance knows whether a policy layer was set, what it checked, or how an attacker managed to get signatures out of it.

The event, meanwhile, also raises questions about why stronger approval controls were not in place, said Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab.

"This looks like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet," he said, referring to cryptocurrency wallets that hold users' "private keys," or unique authorizations, digitally and which are connected to the internet.

The company said on X that an initial investigation suggested the incident may have involved a compromised laptop, but that a subsequent investigation uncovered additional "points of breach."

I don't think those people have the skills needed to elevate their initial access to a full binance compromise within a few hours.

Teng added that the attack "was not carried out by one person"

This closely resembles the Bybit theft, in which North Korean hackers compromised a developer's machine at the wallet provider Safe{Wallet} and manipulated the transaction that Bybit's signers approved.

Binance initially linked the breach to a compromised DevOps engineer's laptop, but now says it has uncovered additional points of breach in a complex attack that "was not carried out by one person".

Teng also disclosed that the attacker used a “self-destruct mechanism” to destroy tools and traces during the breach, complicating the investigation.

The attacker used an EIP-7702 delegation to gain execution authority over a hot wallet, Teng said. That delegation “did not pass through our normal approval controls.”

Something tells me that the timing of the Claude Code supply chain attack is not a coincidence

Was there actually a hack into binance systems, or was it just some insider or credential leak?

Blockaid's transaction security engine classified the type-4 transaction that delegated Binance 14 as malicious on sight, with the reason that an EOA was being upgraded through EIP-7702 to an untrusted address.

The delegation itself was visible onchain for three minutes and 24 seconds before the sweep

The operator address, 0x7C8601d4645b93cea45F71e118A729332e6B5CA0 , was funded through three Tornado Cash withdrawals starting October 28.

“Binance says the attack began with a compromised engineer’s laptop. Targeting crypto company staff is a TraderTraitor hallmark,” Elliptic’s Robinson says.

“This is a problem with EIP 7702, it’s just very, very poorly understood,” Georgiev said.

He said attackers could have drained the funds through other methods, but warned that exchange engineers might overlook the need to revoke a malicious EIP-7702 delegation after regaining control of their systems.

Ben-Natan said attackers may have used a compromised developer’s computer to gain access to Binance’s wallet-signing infrastructure.

“The takeaway is that ultimately the signer signed a transaction that they shouldn’t have,” he said.

Ivo Georgiev, co-founder and CEO of Ethereum wallet provider Ambire, said that EIP-7702 made little difference to the attack because the hackers already had the ability to authorize transactions.

VEER later said the Binance attack appeared broader than a single malicious signature, but that EIP-7702 gave attackers “a handy sweep button on Ethereum.”