Binance Hit by $6.3 Billion Theft: $3 Billion Frozen, Engineer's Computer Compromise Identified as Potential Entry Point

Binance’s preliminary investigation initially pointed to a suspected compromise of a DevOps engineer’s computer. Additional intrusion points were subsequently discovered. The exchange said multiple factors were involved, while the full attack path and how valid signatures were generated remain unconfirmed. Valid on-chain signatures do not establish that private keys were leaked. Whether the attacker abused signing services, and how container permissions may have translated into signing capabilities, remain questions for the technical postmortem. EIP-7702 was used to transfer assets in batches and repeatedly sweep incoming funds, but it cannot explain all the abnormal transfers across multiple chains.