The 29 October Binance asset theft combined a human-controlled intrusion into wallet-engineer systems with abuse of a production signing service. Binance's November 3 incident report puts its internal AI tool in the October 20 lateral-movement chain: a previously compromised engineer workstation and that tool were used to reach two wallet engineers. Binance…
Inspect the ClaimsCase · DiggingBeagle record
Binance wallet-signing compromise used an internal AI tool in its access chain and persistent EIP-7702 delegation
October 2026 Binance compromise connects internal AI-assisted lateral movement to a privileged wallet signer and persistent EIP-7702 sweeps.
Scope
Production exchange compromise, October 20 access expansion and October 29 fund movements. AI involvement is reported by Binance at the internal-tool stage; the on-chain operations are independently observed. The model and degree of autonomy remain undisclosed.
Assessment profile
Assessment method- Setting
- production
- Exploitation
- confirmed in the wild
- Evidence
- Grade B
- Remediation
- fixed reported
- AI role
- WITH AI
Basis and provenance
Binance first-party incident chronology and Blockaid on-chain traces establish a live signer compromise, large unauthorized movements and persistent delegation. Binance reports use of internal AI tooling but no independently published model trace or proof of AI autonomy. Clearing was reported by Binance; a complete independent post-remediation audit is not present. Monetary figures differ by measurement date and frozen/recovered accounting, so impact band remains null.
Assessed Nov 5, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-BIN-AI-TOOL-PIVOT · CLM-BIN-SIGNER-ACCESS · CLM-BIN-BLOCKAID-NONCE-ONE-HIT · CLM-BIN-EIP-CLEARANCE-UTC · Binance initial findings for 29 October wallet-signing intrusion · Blockaid on-chain reconstruction of Binance EIP-7702 delegation and 50 nonce candidates
At a glance
The two decisive security boundaries were authority over engineering systems and authority to produce blockchain signatures. An internal AI tool is reported in the October 20 lateral-movement path, but the public record does not show it independently selecting the wallet exploit. Later, attacker access to the production signer permitted both direct…
Read the implicationsWhich model, prompts and tool permissions were used in the October 20 lateral movement? Which concrete signer requests were authorized and where did transaction-policy checks fail? How much affected value remained unrecovered after frozen/intercepted balances and independent reconciliation? Binance counts 50 signing transactions while Blockaid describes one…
Limits and uncertaintyFull account
The 29 October Binance asset theft combined a human-controlled intrusion into wallet-engineer systems with abuse of a production signing service. Binance's November 3 incident report puts its internal AI tool in the October 20 lateral-movement chain: a previously compromised engineer workstation and that tool were used to reach two wallet engineers. Binance does not identify the prompts, model, delegated decisions or any autonomous exploit selection. Calling this a prompt-injection breach would outrun the evidence.
On October 29 the attacker used deployment credentials to put a malicious container in position to reach the wallet signing service. The attack thus crossed two distinct boundaries: trusted internal engineering tooling became part of an intruder's access path, and signing-service authority was turned into blockchain authorizations. On Ethereum, an EIP-7702 authorization delegated execution to an attacker-controlled sweeper. That delegation was on-chain and persisted even after Binance suspended withdrawals. A separate, complicated MPC-signing procedure was needed to clear it.
Blockaid's independent on-chain write-up distinguishes one type-4 transaction containing 50 authorization candidates from 50 fully accepted delegations. It found a single valid authorization and 49 invalid candidates; the valid one mattered. Binance's initial narrative describes 50 signing transactions, a different unit of counting. Neither difference creates a second theft Case.
Binance estimates USD 6.34 billion in affected assets, and reports USD 2.85 billion frozen or intercepted. Those are incident-state numbers subject to reconciliation, not a verified amount of unrecovered loss. The security pattern is the separation between tool influence, server-side signer policy and persistent downstream authorizations.
The two principal disclosures expose different layers. Binance supplies an internal preparation chronology: a compromised engineer, later use of an internal AI tool for movement to additional wallet engineers, stolen deployment credentials and a malicious container that reached the signer. It does not publish the AI model, prompts or exact tool calls. Blockaid independently reconstructs on-chain movements and a single Ethereum transaction containing fifty candidate EIP-7702 authorizations, with only one matching the current nonce. Binance describes fifty signing transactions without defining their equivalence to those authorization entries. These statements must not be silently normalized to one transaction count. Once the delegation was installed, merely turning off the withdrawal pipeline could not remove it; Binance says an on-chain zero-address authorization cleared it at 00:10 UTC on October 30. The risk was signer authority crossing into persistent smart-contract execution, not evidence that an AI model independently designed the EIP-7702 technique.
Mechanism and trust boundary
- 01
Use compromised engineer access
Attacker previously controlled a workstation, then used an internal AI tool in an October 20 lateral move to wallet engineers.
Boundary: Compromised engineering identity into internal AI tool and wallet engineer computers
- 02
Reach signing service through malicious container
Stolen deployment credentials allowed malicious container execution near an internal wallet signer.
Boundary: Deployment authority into production wallet-signing capability
- 03
Install and exercise on-chain delegation
A signed EIP-7702 authorization delegated execution to sweeper contract, persisting after withdrawals stopped.
Boundary: Signing service approval into independently executable on-chain code
- 04
Revoke on-chain authorization
The exchange had to clear delegated code through a separate MPC authorization sequence.
Boundary: Operational withdrawal suspension versus blockchain authorization state
Timeline
- Oct 20, 2026Event type unspecified
Internal AI tool used in lateral movement
Binance says a previously compromised workstation and an internal AI tool helped the attacker gain control of two additional wallet engineers.
- Oct 29, 2026Event type unspecified
Signer access and unauthorized on-chain transfers
Stolen container deployment credentials enabled a malicious workload to reach the wallet signing service; Blockaid records the nonce-window delegation and initial sweep later that evening.
- Oct 30, 2026Event type unspecified
Delegation cleared on-chain
Binance reports a zero-address EIP-7702 authorization at 00:10 UTC that removed the persistent delegation after the last unauthorized transfer had finalized.
Claims & evidence
CLM-BIN-NONCE-SWEEPBlockaid describes one Ethereum type-4 transaction carrying 50 EIP-7702 authorization entries, of which one valid nonce authorization installed attacker delegation before a subsequent sweep.supported
Basis: reported finding
- supportsBlockaid on-chain reconstruction of Binance EIP-7702 delegation and 50 nonce candidatesindependent technical reproduction
The Nonce Spray: 50 Authorizations, One Hit; EIP-7702 delegation timeline
CLM-BIN-AI-TOOL-PIVOTBinance says attackers used a previously compromised engineer workstation and the company internal AI tool during an October 20 lateral move to two wallet engineers systems; the report does not demonstrate that the AI autonomously selected an exploit.supported
Basis: reported finding
- supportsBinance initial findings for 29 October wallet-signing intrusionprimary disclosure
Attack preparation, October 20 chronology and AI tool involvement
CLM-BIN-IMPACT-FREEZEBinance reports about USD 6.34 billion of digital assets impacted and about USD 2.85 billion frozen or intercepted as of its November 3 statement; impacted assets are not the same measure as a final net loss.supported
Basis: reported finding
- supportsBinance initial findings for 29 October wallet-signing intrusionprimary disclosure
Opening incident summary: impacted assets and frozen or intercepted amount
CLM-BIN-SIGNER-ACCESSBinance reports use of stolen deployment credentials and a malicious container on October 29 to access the internal wallet signing service, allowing transfers outside the normal withdrawal path.supported
Basis: reported finding
- supportsBinance initial findings for 29 October wallet-signing intrusionprimary disclosure
Attack timeline, October 29, stolen deployment credentials, malicious container and wallet signing service
CLM-BIN-EIP-CLEARANCE-UTCBinance states that its final unauthorized on-chain transfer finalized at 23:56 UTC on October 29 and that it cleared the Binance14 EIP-7702 delegation by submitting an authorization to the zero address at 00:10 UTC on October 30.supported
Basis: reported finding
- supportsBinance initial findings for 29 October wallet-signing intrusionprimary disclosure
What happened on 29 October: final transfer and October 30 zero-address clearing
CLM-BIN-BLOCKAID-NONCE-ONE-HITBlockaid observed a single type-4 transaction at 20:20:59 UTC carrying 50 EIP-7702 nonce-candidate authorizations; 49 failed nonce matching and one installed the sweeper delegation. This is a count of authorizations inside one on-chain transaction, not proof that Binance meant the same unit by its separate count of signing transactions.supported
Basis: reported finding
- supportsBlockaid on-chain reconstruction of Binance EIP-7702 delegation and 50 nonce candidatesindependent technical reproduction
The Exploit: How it Unfolded, subsection 2, The Nonce Spray: 50 Authorizations, One Hit
CLM-BIN-DELEGATION-PERSISTENCEBinance says withdrawal suspension did not revoke existing EIP-7702 on-chain wallet delegation; a separate revocation procedure was required because the signer used multiparty computation.supported
Basis: reported finding
- supportsBinance initial findings for 29 October wallet-signing intrusionprimary disclosure
What happened on 29 October, authorization persistence and MPC revocation paragraphs
Implications
The two decisive security boundaries were authority over engineering systems and authority to produce blockchain signatures. An internal AI tool is reported in the October 20 lateral-movement path, but the public record does not show it independently selecting the wallet exploit. Later, attacker access to the production signer permitted both direct transfers and an EIP-7702 delegation whose effect persisted after a withdrawal freeze. Off-chain containment and on-chain revocation are different operations, especially in a multi-party-computation signer environment. A meaningful prevention review must examine who approved each signing request, which target code and nonce it authorized, and whether a backend policy could reject the delegation before signing. The delegated-authority concept explains persistence; the dated affected/frozen values should not be converted into a fabricated final net-loss number.
Controls and mitigations
- Require independent signer-side destination, contract-code and value policies even for validly authenticated internal requests.
- Treat internal AI tools as separate trust principals with limited access to deployment secrets and privileged staff workstations.
- Monitor and revoke persistent account-delegation code on-chain; stopping front-end withdrawal workflows is insufficient.
- Correlate on-chain signer records, credential use and actual tool-call history before assigning autonomous AI actions.
- At the signing boundary, require transaction-level policy for delegated contract targets, chain ID, amount, payee and EIP-7702 authorization semantics; apply nonce-window and behavioral checks before issuing signatures. Emergency revocation must itself be exercised for MPC wallets rather than assumed to follow service shutdown.
Unknowns and contradictions
- Which model, prompts and tool permissions were used in the October 20 lateral movement?
- Which concrete signer requests were authorized and where did transaction-policy checks fail?
- How much affected value remained unrecovered after frozen/intercepted balances and independent reconciliation?
- Binance counts 50 signing transactions while Blockaid describes one transaction with 50 candidate authorizations; these units require reconciliation.
Sources and citation
Material revision history
- Nov 5, 2026 · Published version · first publication · revision 221