After Binance, check what your signing systems can approve
Summary: Binance's November 3 report described an October 2026 attack that combined social engineering, misuse of an internal AI tool, stolen credentials, and unauthorized access to its wallet-signing service, with an attacker using a compromised DevOps laptop to reach a service container and submit unauthorized withdrawals. The attacker obtained valid signatures without extracting private keys, and used an EIP-7702 delegation - a standing instruction kept in place until changed or cleared with the wallet's key - to enable repeated transfers, including funds deposited after the first theft, while other Binance wallets were drained through ordinary signed transfers.
What you should know: A server with permission to request signatures can misuse a protected key without ever extracting it, and an EIP-7702 delegation let the attacker keep pulling funds, including deposits made after the first theft, without further signatures from Binance. If your monitoring only watches transfers and ownership changes, the shift in wallet authority goes unseen until assets move.
Read the original at Trail of Bits Blog ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026