GCSA Validates 50 Binance EIP-7702 Signatures in Forensic Review

GCSA's forensic review of Binance's incident, which had an estimated $6.3 billion impact, verified 50 EIP-7702 signatures but could not establish whether private keys were exposed during the attack.

The Oct. 30 review examined 18 original transactions, validating 50 initial authorization signatures associated with Binance 14 and one revocation signature. It also tracked contract calls, asset transfers and the later removal of the delegation. Its data snapshot ended at 1:03 a.m. ET (05:03 UTC) Oct. 30.

An Ethereum type-4 transaction can carry 50 authorizations, but that does not mean all 50 delegations took effect. A signature that passes validation demonstrates the ability to sign at that point; it cannot show whether a key leaked, a signing service was misused or an approval process was manipulated.

The review was limited to key Ethereum transactions and did not cover all 10 chains affected by the incident. EIP-7702 lets a standard Ethereum account authorize smart-contract code to run for it. Identifying the root cause or an operator requires off-chain evidence, such as service records.