Binance’s November 3 initial report links the October 29 incident to fake recruitment, compromised employee devices and internal AI tooling, followed by stolen deployment credentials and unauthorized signing-service access. These are the company’s preliminary findings, not an independently validated postmortem.

Why a withdrawal halt was insufficient

Binance says malicious EIP-7702 delegations kept operating outside its withdrawal infrastructure. It reports clearing the delegation at 00:10 UTC on October 30 after a previously broadcast transfer finalized at 23:56. Affected systems were rebuilt and credentials retired, it says.

Financial figures require separate labels

The report estimates $6.34 billion impacted and $2.85 billion frozen or intercepted, subject to reconciliation and prices. Binance says it reserved more than full replacement funding and replenished 98% of impacted token assets by October 31. That does not establish that stolen funds returned.

The protocol distinction

The Ethereum specification allows an account to delegate code execution persistently. It also defines how an authorization to the zero address clears that code. These mechanics explain why an exchange’s internal service switch and an on-chain permission are different control points. They do not independently establish how an attacker gained signing access, or prove that Ethereum itself was compromised.

What evidence comes next

An external review can test the relationship between endpoint access, deployment permissions and signing controls. Readers should look for its scope, methodology and any qualifications, rather than treating a company narrative as the review’s conclusion. A repaired system, replacement assets and recovered stolen property are also different outcomes; each needs its own evidence.

Our earlier technical coverage preserves the hypotheses and third-party analysis available before this report. The separate withdrawal-route record tracks operational notices without implying universal availability.

For background, see wallet custody and signing authority and account security and recovery scams.

Sources checked November 3, 2026, 14:58 UTC. The Token Press has not independently reconstructed the intrusion or audited the financial figures.