BINANCE’S OWN REPORT PUTS THE ALERT BEFORE THE BITCOIN — 18,270 BTC LEFT AFTER IT — NO CLOCK TIME FOR EITHER, AND EIP-7702 CAME LATER
Binance published its first report on the hack at 14:33 UTC on November 3, 2026. It walks through October 29 in order. Five hot wallets sent 233.46 million XRP between 20:05 and 20:09 UTC. Wallets on Solana and Optimism paid out. Then this: “Binance then received an internal alert regarding large-volume transfers and immediately began investigating.” And the next line: “Binance hot wallet sent 18,270 BTC to an attacker-controlled address.”
The report gives no clock time for the alert or for the bitcoin. The chain gives one for the bitcoin. Block 973,732, mined at 20:20:06 UTC, carried the 11 spends totaling 18,270.2 coins, about 11 minutes after the XRP window closed. The report gives no time for the withdrawal halt either. At 23:09 UTC that night, Binance’s public coin list, which we pulled and reported, still showed bitcoin withdrawals switched on.
The report also moves EIP-7702, the Ethereum feature co-CEO Richard Teng cited on October 30, to after the bitcoin: “The attacker then used the signing service to exploit Ethereum’s EIP-7702 authorization mechanism.” Its reason containment took so long, on-chain permissions that kept working after withdrawals stopped, is an Ethereum problem. Bitcoin has no such permission to revoke. The bitcoin needed one thing, a signature from what the report calls “an internal wallet signing service.” The report says the Ethereum hot wallet used MPC, so “there was no single private key.” It does not say how the bitcoin wallet signed. All 11 spends show one public key, and MPC and a single key look the same on chain.
Binance says it is reviewing “signing policy coverage” and “hot wallet controls.” It does not say what the signer checked before it signed for 18,270 coins, or when the people reading that alert could have stopped it. The network checks that a signature is valid. It cannot check why. At block 974,419, mined at 17:54 UTC on November 3, the 19 addresses the FBI listed still held the coins and had spent nothing, on two explorers. At the time of this writing, bitcoin was $77,592.