“It's like saying you have, let's say, a pen in a bank that is used to write checks. Every customer that goes to the bank and wants to withdraw money, that pen is used to write the checks. They didn't steal the check, but they were able to access the pen inside the bank and sign transactions. … Nine out of ten of the big attacks that happened in the last three years all start with a laptop being infected.”
Unchained · Crypto & Web3 · November 2026
Context
Laura Shin asked Pablo to walk through what the attacker actually did at Binance. He explains that, from what Binance has said, no wallet private keys leaked; the attacker got access to the system that signs transactions and used it to sweep the hot wallets.
Transcript
…up. The assets were sat in the initial theft addresses. And as people were totally up the tools and looking for more chains and more assets where Binance hot wallets have been drained, ultimately about $6.4 billion had been lost, which is, as you just said out, absolutely unimaginable in scale.
And Pablo, your company wrote a little tweet thread explaining what exactly the attacker did. Can you walk us through it?
Yeah, about the biggest hack or theft ever until now. Until now. I really believe things are going to get far worse than this. So yeah, basically what happened here is that from what we know, from what Binance said, a developer's laptop was compromised, right? If we see what has been happening in the last three years, nine out of ten attacks of the big attacks that happened, all of them start with a laptop being infected, right? It's not just that it's just the laptop, but they start there. A developer laptop is infected. From there, they were able to access a service container and they were able to sign transactions, right? What we think, right? Because Binance didn't say too much up to now, is that there was no access to the private keys from the hot wallet from Binance, but the attacker was somehow able to sign transactions, right? So they had, it's like saying that you have, let's say, a pen in a bank that is used to write checks. So every customer that goes to the bank and wants to withdraw money, that pen is used to write the checks. So they didn't steal the check, but they were able to access the pen inside the bank and sign transactions. So they basically started signing…
Yeah, every time new deposits came in, it automatically would take them out right at that moment. Let's talk about this bit about the EIP 7702 delegation because so this is an upgrade that went live with Petra about a year and a half ago. And essentially it lets a standard crypto wallet on…
I mean, when EIP 7702 was being designed, I remember that I tweeted about this. I said I don't like this too much, right? Because it will allow basically for drainers to drain more assets in one transaction, right? So I thought that it could be an issue. But anyways, what we have to make clear here…
Yeah, I totally agree. Obviously, we see 7702 being used by Drainer Kits lots and lots these days. And yeah, okay, that upgrade has been like, I guess, made their operations more efficient. But really, the story here is not about that EIP. It's a story of operational security. It's a story of…
More from Unchained
