The signing service answered

The withdrawal switch did nothing. The signing service had already said yes.

Binance’s first findings, today: about $6.34 billion in digital assets moved on 29 October. The path did not start that afternoon. A tainted developer install in June. A fake job interview in September. On 20 October, a machine from that interview and an internal AI tool reached two wallet engineers. On the 29th, stolen credentials stood up a container. Funds started leaving at 20:05 UTC — XRP, SOL, OP, then 18,270 BTC — and then the signing service was asked for EIP-7702 authorizations, fifty of them, to put a contract on a hot wallet and keep the nonce where the attacker needed it.

That is not a stolen seed. That is the component that produces signatures, asked directly, around the policy that lives on withdrawals. Suspending withdrawals left the delegation on-chain. The wallet is MPC. There was no single key to sign a revoke. Last unauthorized transfer, 2,961.9 ETH, at 23:56 UTC. They cleared the Binance 14 delegation at 00:10 on the 30th with a procedure they had to write that night.

About $2.85 billion frozen or intercepted, still moving with price. About 98 percent of the affected tokens replenished from the company’s own money as of 31 October, some illiquid units still being sourced. Users, they say, are not the loss. Independent review promised. Some of the internals stay unpublished.

What $6.34 billion will be asked to cover

It will be briefed as every Binance customer emptied, and as a key that walked out of a building. It is a signing service that will sign a 7702 tuple if you can reach it, and an MPC wallet whose revoke path had never been built. It is not the 29 October on-chain labels we already had. Those were the drain. This is how the drain was asked for.

It will be briefed as a person at a desk. Four months, a fake interview, an internal copilot, fifty authorizations, four hours to undo one. That is a loop that already had a seat inside. The 24/7 version does not need a new interview every time. It needs a signing service that still answers, and a 7702 that still persists after the withdrawal page goes orange. This report does not prove a swarm of agents. It proves the interface they would call.

If you hold on Binance, their replenish is the letter until they retract it. A “re-authorize the MPC” page is not them.

The signing service answered. The withdrawal switch was a different wire.