Binance's $6.3B Hack: Attackers Didn't Steal Keys, They Weaponized a Signer via EIP-7702
The same failure pattern applies to any system with signing or tool-calling capabilities: a valid key that can be used to approve unintended operations is a security boundary, not just key storage. For engineers building wallets, exchanges, or AI agents, the lesson is that permission granularity—what a given signature is allowed to authorize—matters more than the strength of the key itself.
Binance suffered the largest crypto hack yet on October 29, 2026, with $6.3B drained from hot wallets. The official announcement found no private key leak, but the attackers had used the exchange's own valid signatures to delegate a hot wallet (Binance 14) to a contract they controlled. The technical vector was EIP-7702, which lets an EOA delegate execution to a contract via a signed authorization. The attacker submitted 50 authorizations with consecutive nonces; only one matched the wallet's current nonce, but the protocol silently skips invalid ones, so the transaction succeeded and the wallet became a sweeper. That single delegation allowed the attacker to sweep ETH, USDT, and 60 other tokens in minutes.
The attack chain started with a compromised DevOps laptop giving access to a service container that could request signatures. The signer didn't validate the semantic difference between a transfer and a delegation, so it signed what it was asked to sign. A subsequent freeze asymmetry is striking: Tether and Circle froze $1.567B USDT and $800M USDC within an hour, but 18,270 BTC (~$1.47B) could not be frozen by anyone. TRM Labs and Chainalysis attribute the attack with high confidence to North Korea's TraderTraitor group, though Binance itself has not named an attacker and no government agency has issued a formal attribution.
The article draws engineering lessons that generalize beyond crypto: treat authorization as a first-class auditable object with TTL, quotas, target whitelists, and semantic constraints; keep signer permission granularity finer than you think; detect EIP-7702 delegation cheaply via eth_getCode checking for the 0xef0100 prefix; and recognize that AI agent tool-calling loops are structurally similar to signing systems, where prompt injection is just another attempt to make the signer approve a payload it shouldn't.
The silent-skip design for invalid EIP-7702 authorizations turned a blind spray of 50 signatures into a one-shot hit; the tolerance that helps batch onboarding also amplifies abuse, and this is a textbook example of a design tradeoff becoming a security amplifier.
The freeze asymmetry reveals that the 'emergency brake' in crypto is effectively held by a handful of private issuers, not by the protocol itself, and that power is indiscriminate—it can freeze any holder, not just criminals.
The shift from key leak to key misuse means the traditional threat model of custody security (HSM, MPC, cold storage) is insufficient; the real boundary is the semantic validation of what a signature is allowed to authorize.
Attributing to TraderTraitor with 'high confidence' while Binance and no government agency officially name a culprit shows the gap between on-chain intelligence and legal or operational accountability.
The mapping to AI agent tool-calling is not a metaphor but a structural identity: a tool-calling loop is a signer that decides what to call based on context, and prompt injection is an attempt to make it sign a payload it shouldn't—so agent systems need the same TTL, quota, whitelist, and semantic constraints.