Figure 1 is the timeline and the split between frozen value and value beyond issuer reach.
Figure 1: Theft timeline on 29 October 2026 and the split between frozen stablecoins and ETH and BTC beyond issuer reach.
Timeline of 29 October — the drain and the freeze gap decide what issuers could still stop.
Deep technical attack chain — the EIP-7702 spray, the persistent sweeper delegation, and the signing misuse question decide the fix.
Attribution to TraderTraitor — the Bitget fund-flow link and the unpublished off-chain intelligence decide the confidence ceiling.
USDT and USDC freeze mechanics — blacklist, burn-and-reissue, and controlled unblacklisting decide what frozen value can ever return.
Why ETH and BTC cannot freeze — the absence of an issuer control decides why conversion, not theft alone, sealed the loss.
Binance solvency arithmetic — SAFU against the net loss decides the size of the company-fund gap.
AI agents — the absence of agent evidence in the attack chain, against defender-side detection claims, decides the AI question.
Builder playbook — signing policy, delegation monitoring, pre-signed revocation, and issuer coordination decide the next defence.
Hold only working balances in a hot wallet. A hot wallet that signs continuously can drain in minutes, as Binance wallets did in about 20 minutes. Larger balances belong in warm or cold storage behind slower approval paths, sized so a loss inside the detection-to-freeze window stays survivable.
Separate wallets by tier and by chain. Hot, warm, and cold wallets must not share one signing service, one credential set, or one approval path, and no single human, laptop, or service container may authorise transfers across all chains.
CSA's Crypto-Asset Exchange Security Guidelinesset out hot-wallet and cold-wallet separation as exchange-operator best practice.Require multisig and a second approval for material transfers. Cold-wallet transfers need multisig, and any large transfer, new destination, or cross-chain transfer needs approval on a separate device from the request. A single laptop or service container must never be enough to move exchange funds.
Harden engineer laptops that touch signing. Privileged DevOps laptops need endpoint controls, separate credentials, and no direct path to request signatures without that second approval, because Binance said a compromised DevOps laptop gave access to a service container that submitted unauthorised withdrawals.
Pre-sign delegation revocation and monitor hot addresses for code changes every block. A delegation persists after a sweep, so a tested revocation ready for submission matters more than detection alone.
Pre-agree issuer freeze coordination. Pre-label hot addresses with Tether, Circle, and every other issuer, and agree the freeze-request format in advance, because the 37-minute gap before the first freeze allowed hundreds of millions to convert into assets no issuer can freeze.
Hold a reserve buffer above 100 percent for hot-wallet coins, larger for ETH and BTC with no issuer freeze.
A Comprehensive Guide for Web3 Securitytreats wallets, smart contracts, and DevSecOps processes as foundational Web3 security building blocks.
Both of these works came from work we did with fellow researchers a few years before this incident — the CSA guidelines in 2021 and the book in 2023 — and their controls still apply to this incident and to the future security of crypto and blockchain systems.
