The report
Two separate trust boundaries
Binance's November 3 initial incident findings say an attacker used an already-compromised engineer's machine and an internal AI tool on October 20 to reach other wallet engineers. The report does not disclose the model or requests and does not identify a prompt injection. On October 29 the attacker used stolen deployment credentials to operate a malicious container that could reach the exchange's wallet-signing service.
The effect was not limited to ordinary withdrawals. The signer produced an EIP-7702 authorization on Ethereum that installed attacker-controlled executable delegation. Blocking withdrawals did not remove already-established on-chain authorization. A new signed operation was required to revoke it. See the single canonical incident Case and delegated-authority pattern.
What was actually measured
Binance reports about USD 6.34 billion in assets impacted and about USD 2.85 billion frozen or intercepted as of its update. These should not be collapsed into a single confirmed unrecovered-loss figure. Blockaid's on-chain reconstruction describes 50 nonce-candidate authorization entries in one type-4 transaction, one valid and 49 invalid, followed by a substantial sweep. Binance uses the phrase "50 signing transactions" for part of the sequence. The two descriptions use different units and require careful reconciliation.
A separate Chainalysis internal-tool incident is unrelated according to Chainalysis. AI was one reported access-stage ingredient in the Binance case; the observed wallet-signer and blockchain mechanisms stand on their own evidence.
Sequence and counting units
The exchange dates the internal AI-tool pivot to October 20, the deployment-credential and signer compromise to October 29, the final unauthorized transfer to 23:56 UTC on October 29, and the on-chain delegation cleanup to approximately 00:10 UTC on October 30. That order separates initial access, permission to sign and continued asset movement. The Blockaid report identifies one effective authorization among fifty candidate entries in a transaction; it does not report fifty successful delegations. Neither account contains enough public model prompts, agent states or independent operator logs to assign autonomous responsibility for the chain-level action. The signing boundary should be analyzed as a production authorization failure even if subsequent evidence changes the role attributed to the internal AI tool.
The control that failed after withdrawals stopped
A withdrawal switch governs an exchange application, whereas an EIP-7702 authorization changes what a blockchain account can execute. Once the attacker established the latter, it persisted independently of the exchange's withdrawal workflow. Binance says its multi-party-computation wallet could not clear the delegation with one readily available private-key signature, so revocation required a specialized procedure and further transactions. The effective unit is a signed delegation state, not simply the number of failed or attempted candidate entries. Blockaid's analysis is valuable for the on-chain authorization but does not reconstruct the hidden October 20 AI-tool prompts. The Binance Case therefore retains both tracks and treats the $6.34 billion affected value and $2.85 billion frozen/intercepted value as dated, different measures, not a definitive net loss.