Binance initial findings for 29 October wallet-signing intrusion

Evidence record

Exchange disclosure of earlier workstation compromise, AI-tool lateral movement, 29 October wallet signer misuse and containment limits.

Read the original source ↗

Claim-level citations (5)

• supportsBinance wallet-signing compromise used an internal AI tool in its access chain and persistent EIP-7702 delegation: Binance says attackers used a previously compromised engineer workstation and the company internal AI tool during an October 20 lateral move to two wallet engineers systems; the report does not demonstrate that the AI autonomously selected an exploit.

  Attack preparation, October 20 chronology and AI tool involvement

• supportsBinance wallet-signing compromise used an internal AI tool in its access chain and persistent EIP-7702 delegation: Binance reports about USD 6.34 billion of digital assets impacted and about USD 2.85 billion frozen or intercepted as of its November 3 statement; impacted assets are not the same measure as a final net loss.

  Opening incident summary: impacted assets and frozen or intercepted amount

• supportsBinance wallet-signing compromise used an internal AI tool in its access chain and persistent EIP-7702 delegation: Binance reports use of stolen deployment credentials and a malicious container on October 29 to access the internal wallet signing service, allowing transfers outside the normal withdrawal path.

  Attack timeline, October 29, stolen deployment credentials, malicious container and wallet signing service

• supportsBinance wallet-signing compromise used an internal AI tool in its access chain and persistent EIP-7702 delegation: Binance states that its final unauthorized on-chain transfer finalized at 23:56 UTC on October 29 and that it cleared the Binance14 EIP-7702 delegation by submitting an authorization to the zero address at 00:10 UTC on October 30.

  What happened on 29 October: final transfer and October 30 zero-address clearing

• supportsBinance wallet-signing compromise used an internal AI tool in its access chain and persistent EIP-7702 delegation: Binance says withdrawal suspension did not revoke existing EIP-7702 on-chain wallet delegation; a separate revocation procedure was required because the signer used multiparty computation.

  What happened on 29 October, authorization persistence and MPC revocation paragraphs