High · 1 source · latest 3h

Binance breach shows why signing systems must catch wallet authority changes

CRYPTOBinanceredteam/daily · 1 source

Severity: High
Sources: 1

What happened

Binance's November 3 report described an attack involving social engineering, misuse of an internal AI tool, stolen credentials and unauthorised access to its wallet-signing service. The attacker obtained valid signatures and used an Ethereum EIP-7702 delegation to make repeated transfers without further approval, while other wallets were drained through ordinary signed transfers. The article urges teams to restrict signing access, treat delegation as an administrative privilege, protect funds with independent custody controls and monitor changes to wallet authority.

For IT people · Written by AI from 1 source · Wrong?

What to do

Document every service and API that can request wallet signatures and restrict what each can authorise.
Reject EIP-7702 delegation requests for custody accounts that do not need delegation, through both dedicated and generic signing interfaces.
Protect funds with separate custody controls that the operational key cannot change, and test that delays and limits cannot be bypassed.
Update detection rules so alerts cover delegation changes and module or ERC-4337 execution paths.

Written by AI from the sources, checked against them

Read the full story at the source