Binance Incident Reveals New Risks in Wallet Signing Systems
A recent security incident at Binance highlights critical vulnerabilities in how organizations manage and monitor wallet signing systems, particularly with the emergence of new transaction delegation methods.
Binance's October 2026 security incident has exposed a significant operational risk for any organization managing user funds: the potential for compromised signing systems to grant attackers wallet authority without ever exposing private keys. The attack, initially attributed to a compromised DevOps laptop, evolved to involve social engineering, misuse of internal AI tools, stolen credentials, and unauthorized access to Binance's wallet-signing service. Crucially, the attacker managed to obtain valid signatures, demonstrating that a server with signing privileges can misuse protected keys without extracting them.
The core of the exploit leveraged EIP-7702 delegation, a mechanism that allows a wallet to sign a standing instruction. This instruction, effectively a "use this code when my account is called" directive, remains active until revoked by the wallet's key. This allowed the attacker to repeatedly execute unauthorized transfers, even draining funds deposited after the initial theft, without requiring further explicit signatures from Binance. While other Binance wallets were compromised through more conventional signed transfers, the EIP-7702 delegation represented a novel and particularly insidious attack vector.
This incident underscores a critical need for transaction execution and monitoring systems to keep pace with the evolving Ethereum ecosystem. New standards like EIP-7702 place delegation authorizations outside of standard calldata, making them harder to detect with traditional methods. Furthermore, the rise of session keys, various recovery paths, authorization modules, smart contract wallets like Safe, and ERC-4337 UserOperations introduce multiple new execution paths that must be understood and monitored by signing policies.
Organizations that have not updated their detection rules and monitoring systems may fail to recognize malicious changes in account authority or asset movements, leaving their wallets vulnerable. Trail of Bits, in response to these evolving threats, has outlined a four-step approach to strengthening wallet security. This includes reducing access to signing infrastructure, treating delegation as an administrative privilege, limiting damage even if signing is compromised, and diligently detecting changes in wallet authority.
The first recommendation emphasizes meticulous documentation of all services and APIs that can request wallet signatures, including who can call them and what actions they can authorize. It also stresses the separation of signing infrastructure from everyday business systems and the verification of transaction details through independent systems. The TRAIL method is proposed to trace potential compromise paths from a compromised system to the signing infrastructure.
Secondly, treating delegation as an administrative privilege involves configuring signing services to specifically recognize requests that alter account authority. For externally owned accounts (EOAs) that do not require delegation, EIP-7702 authorizations should be rejected. Where delegation is necessary, separate approval must be granted for the authorizing account, delegate address, chain, and nonce. Crucially, simulations must be performed to inspect changes in permissions and future execution authority alongside immediate balance changes before any transaction is evaluated.
The third recommendation focuses on limiting damage even when signing capabilities are compromised. This means implementing separate custody controls that the operational key cannot alter, even after delegation. These controls can include independently enforced limits, monitored delays on sensitive actions, and a separate configuration authority, as described in cold-storage guidance.
Finally, detecting changes in wallet authority is paramount. This involves mapping each wallet to the assets and contracts it controls, and setting up alerts that identify affected systems and privileges. Direct calls, module executions, and ERC-4337 operations must be attributed to their authorization paths. Monitoring systems should be capable of reconstructing the order of authority changes and asset movements, distinguishing detection from controls that prevent execution before funds are lost.
The Binance incident serves as a stark reminder that securing wallet infrastructure is an ongoing responsibility. Security teams must continuously review and test their signing policies, ensure independent safeguards remain effective, and verify that their monitoring systems can detect subtle but critical changes in account permissions and authority.