Statements

“The takeaway is that ultimately the signer signed a transaction that they shouldn’t have,” he said.

Ivo Georgiev, co-founder and CEO of Ethereum wallet provider Ambire, said that EIP-7702 made little difference to the attack because the hackers already had the ability to authorize transactions.

VEER later said the Binance attack appeared broader than a single malicious signature, but that EIP-7702 gave attackers “a handy sweep button on Ethereum.”

“The 7702 upgrade is a way to do this in one sweep and maybe a way to bypass some sort of checks they may have,”

Attackers could have stolen the funds without EIP-7702, Ido Ben-Natan, Blockaid’s co-founder and CEO, told Cointelegraph on Friday.

Check Point's Dave said this attack also resembled a hack on crypto exchange platform Bitget in September in which $388m (£289m) was lost: "This implies that attackers no longer need the vault keys. They target the systems and people with authority to use them."

My money is on an inside job.

Binance’s investigation into its $6.3 billion hack has uncovered “additional points of breach,” the exchange said , after initially pointing to a potentially compromised laptop. The exchange said it was still gathering facts in coordination with law enforcement. Binance said it remained on track to resume withdrawals in 45 hours, while deposits remained unaffected.

Binance wallets on the other nine chains sent funds to the attacker through ordinary signed transfers.

Early indicators on the Ethereum activity suggested the attacker had phished the authorizations. That explanation covers Ethereum and leaves the other chains unexplained.

Preparation began at least 36 hours before the theft. The attacker's operator wallet received three small withdrawals from Tornado Cash, a service that obscures where crypto comes from, starting the morning of October 28.

In TRM's assessment, the most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains.

Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak.

Binance's update of 02:23 UTC, Oct 30 , says its initial investigation "suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions," and that it has "found no evidence of any wallet private key leak."

a compromise of signing infrastructure. We don’t think a key was leaked,” he said.

The hackers were able to manipulate a system used to approve transactions to move money out of a Binance-controlled, internet-connected so-called "hot" wallet in a way that did not pass through normal approval controls, Teng said.

Binance's other co-CEO, Richard Teng, said in a post on X that the breach was a "complex attack" that was not carried out by one person and included a compromised laptop as well as malicious software designed to delete evidence of its activity as it went along, "making it more difficult for us to trace and investigate."

co-CEO Richard Teng said the attacker "did not simply use one engineer's permissions, and this was not a single 'one-click' action."

You split it into thousands and then use hardware security modules with a risk management system so it doesn't let you transfer $5bn instantly. Unless it was an inside job maybe? I'd be really curious to know what their security architecture was.

inside job /exit strategy.

The attacker first drained Binance 14 starting 20:24 UTC in a single transaction worth about $2.5B, minutes after Binance’s own signing infrastructure, under the attacker’s control, signed an EIP-7702 authorization delegating it to an attacker-deployed sweeper.

At 20:20:59 the operator sent a type-4 transaction to Binance 14, 0x28C6c06298d514Db089934071355E5743bf21d60 , carrying 50 EIP-7702 authorizations signed with the Binance 14 key, one per nonce from 18,914,775 to 18,914,824, each delegating the wallet to the sweeper.

At 20:20 UTC, the operator submitted a single transaction containing 50 authorizations. Each was signed by the Binance hot wallet, and each pointed it to a sweeper contract that accepts instructions only from the operator.

The final contract went live at 15:59, a second rehearsal exercised the sweep path three times between 16:25 and 16:47, and the test funds were routed back.

At 13:51 they ran a rehearsal that is worth a second look: a test wallet delegated with three authorizations at nonces 0, 1 and 2, of which exactly one applied.