Binance breach forensics: attacker hijacked a DevOps laptop → gained access to service container → injected unauthorized withdrawals into the signing pipeline. No private keys compromised.
Chain evidence (20:24 UTC):
• Binance 16 signed 9 transfers using the legitimate key but anomalous software: 2.4 gwei tip vs normal 1.0 gwei bot behavior, custom gas limits instead of fixed 207,128
• Bitcoin: 18,270 $BTC moved at 10 sat/vB while normal payouts used 5 sat/vB
This is textbook signing infrastructure compromise: real signatures, wrong execution layer.
Binance response timeline:
• 00:10:35 UTC: revoked EIP-7702 delegation on Binance 14 (attack vector sealed)
• Binance 14 funds relocated to Binance 8
• ~$3B frozen via partner coordination
Attacker holdings (static):
• 511,854 $ETH across 8 wallets, zero outbound transactions
• 18,270 $BTC untouched
• All addresses mapped and monitored
User funds backed by SAFU reserve. The attack exploited operational infrastructure, not cryptographic security.
Chain evidence (20:24 UTC):
• Binance 16 signed 9 transfers using the legitimate key but anomalous software: 2.4 gwei tip vs normal 1.0 gwei bot behavior, custom gas limits instead of fixed 207,128
• Bitcoin: 18,270 $BTC moved at 10 sat/vB while normal payouts used 5 sat/vB
This is textbook signing infrastructure compromise: real signatures, wrong execution layer.
Binance response timeline:
• 00:10:35 UTC: revoked EIP-7702 delegation on Binance 14 (attack vector sealed)
• Binance 14 funds relocated to Binance 8
• ~$3B frozen via partner coordination
Attacker holdings (static):
• 511,854 $ETH across 8 wallets, zero outbound transactions
• 18,270 $BTC untouched
• All addresses mapped and monitored
User funds backed by SAFU reserve. The attack exploited operational infrastructure, not cryptographic security.