Global Cyber Alliance's Binance Hack Probe: 50 EIP-7702 Signatures Valid, Private Keys Not Proven Compromised

GCSA Report: Valid Signatures Don’t Prove Private Key Theft in Binance Hack

Taipei, Taiwan – October 30, 2023 – The Global Cyber Security Alliance (GCSA), in collaboration with the AI and Cybersecurity Research Center co-hosted by the University of Hong Kong, released version 2.0 of its independent forensic report today, titled “Independent Forensic Analysis and EIP-7702 Attack Chain Linkage Analysis of the Approximately $6.3 Billion Binance Theft.” The report scrutinizes on-chain signatures and authorizations, concluding that valid signatures demonstrate signing capability but cannot definitively prove whether private keys were compromised.

On-Chain Verification and EIP-7702

The GCSA report, released at Taipei time on October 30, focuses on publicly verifiable transactions, signatures, and states rather than solely on the total loss amount or attacker attribution.

In simplified terms, EIP-7702 allows a standard account to “borrow” contract code for execution after signing an authorization. The attackers reportedly used a batch of authorizations to align with the nonce of high-frequency wallets. Once a match was found, they proceeded to drain assets. Approximately 3 hours and 49 minutes later, a zero address was used to authorize the cancellation of these delegations. GCSA’s v2.0 report meticulously dissects this critical Ethereum transaction chain.

Report Scope and Findings

The report reviewed 18 original transactions and their outer signatures, verifying 50 initial EIP-7702 authorization signatures related to Binance, along with one revocation signature. It also tracked delegated calls, asset transfers, zero-address revocations, and the state of frozen wallets at specific blocks. The data cutoff was October 30, 2026, at 05:03 UTC (1:03 PM Taipei time), with the on-chain anchor block being 26303316.

A key distinction highlighted is that a single type-4 transaction accommodating 50 authorizations does not imply that all 50 delegations were successfully executed. A valid signature merely proves the signing capability at that moment; it cannot retroactively determine if a private key was stolen, nor can it identify which internal system initiated the request. Valid signing and the absence of private key compromise are not synonymous. On-chain data inherently cannot differentiate between key leakage, the abuse of signing services, or the manipulation of approval processes.

Third-Party Services and Unsubstantiated Claims

GCSA also examined three consecutive transactions associated with MetaMask Gas Station. The amount of ETH deposited precisely matched the maximum gas budget for the subsequent two transactions. Such correlations can serve as verifiable clues for analyzing interactions with third-party services and are suitable for legal preservation of service logs. However, they do not equate to obtaining real IP addresses, nor can they directly identify the operator.

The report explicitly labels claims such as “attacker mistakenly selected USDT,” “MetaMask holds real IP,” and “identity locked via IP” as unsubstantiated speculation. The full text deliberately separates findings into three tiers: observed on-chain facts, technically inferred deductions with supporting evidence, and root causes and identity attributions that require off-chain investigation.

Contextualizing Attributions

While the initial official investigation narrative pointed to a compromised DevOps engineer’s laptop affecting service containers and unauthorized withdrawal processes, and on-chain intelligence firms like TRM have attributed the attack to North Korean-related threat activities or TraderTraitor with high confidence, GCSA reiterates in its report that these assessments provide context but are not independently confirmed by the alliance and cannot replace transaction-by-transaction technical verification.

This logic also applies to the scope of the research: the focus was on reviewing the critical Ethereum transaction chain, not a full audit of all ten chains. Assets entering a blacklist do not mean they have been recovered, and the official estimated loss of approximately $6.3 billion should not be directly considered the final net loss.

Current Status and Broader Security Implications

As of the report’s snapshot, the target addresses remain on the USDT blacklist, holding approximately 175 million USDT (specifically 174,999,872.327620). The cancellation of delegations, asset freezing, and actual asset return are distinct events in terms of evidence. For users and the ecosystem, this independent forensic analysis draws a clear line between what can be publicly verified and what still requires off-chain evidence. It also serves as a reminder that the security perimeter for digital assets extends beyond a single private key to encompass endpoint devices, signing services, authorization approvals, and third-party infrastructure.