Binance Links $6.3B Incident to Unauthorized Withdrawals

Binance’s initial investigation pointed to a possible compromised DevOps laptop, access to a service container, and unauthorized withdrawal transactions, according to StepSecurity’s account of the exchange’s disclosures. Binance later identified additional breach points. The exchange estimated roughly $6.3 billion in affected assets and reported that partners helped freeze about $3 billion. Its initial statement reported no evidence of a wallet private-key leak; the laptop infection method remains under investigation.

The service between a developer identity and a protected signer is worth examining. StepSecurity relays blockchain researchers’ reports of 50 signed Ethereum EIP-7702 authorizations across consecutive nonces and a delegation that supported at least six later sweeps. It also recounts conventional signed transfers on other chains.

Preserve deployment, container-access, approval and signer-request logs for the incident window. Match request initiators and wallet transactions to approved withdrawals, then inspect the developer identities that could reach the service. On a matched device, preserve evidence and revoke exposed sessions and credentials from a clean machine. Restrict future withdrawal-service calls to approved service identities. Verify a revoked credential is rejected and the denied request appears in the withdrawal service access log; confirm new requests follow the intended approval path.