Binance breach shows why signing systems must catch wallet authority changes
- Severity
- High
- Sources
- 1
What happened
Binance's October 2026 incident involved a compromised DevOps laptop, social engineering, misuse of an internal AI tool, stolen credentials and access to its wallet-signing service, which yielded valid signatures; the November 3 report says no private keys were extracted. An attacker used an EIP-7702 delegation to set a standing execution instruction on an EOA, enabling repeated transfers, including of later deposits. Defenders should inventory every service able to request signatures, reject EIP-7702 authorisations on custody EOAs that do not need delegation, approve delegate, chain and nonce separately, and simulate delegation changes. Monitoring should reconstruct authority changes across direct calls, modules and ERC-4337 operations.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Document every service and API that can request wallet signatures and restrict what each can authorise.
- Reject EIP-7702 delegation requests for custody accounts that do not need delegation, through both dedicated and generic signing interfaces.
- Protect funds with separate custody controls that the operational key cannot change, and test that delays and limits cannot be bypassed.
- Update detection rules so alerts cover delegation changes and module or ERC-4337 execution paths.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Companies