The investigation is moving toward Binance's signing infrastructure
A possible compromise of Binance's internal signing keys is emerging as the leading technical theory behind the multichain incident.
Solid Intel reports that Binance 14 remains compromised and that the incident involving Binance 16 may have escalated to a compromise of its signing key. Andy relayed the same assessment, describing the Binance 14 key as compromised and the Binance 16 key as a potential additional compromise.
This is not yet a technical conclusion published by Binance. It is an attributed intelligence assessment based on the observed wallet activity.
Why this is more serious than an EIP-7702 delegation exploit
The first technical theory focused on EIP-7702, an Ethereum mechanism that lets an externally owned account temporarily delegate execution to smart-contract code. A malicious delegation can create dangerous spending authority without the victim necessarily understanding what was approved.
A signing-key compromise is different. If an attacker controls the private key or the signing system behind a Binance wallet, the attacker can authorise transactions directly as that wallet. The risk is no longer limited to one malicious delegation or contract interaction; it may extend to every asset and network accessible through the compromised signing infrastructure.
That distinction could help explain why the suspected incident expanded beyond the first Ethereum transfers and was later attributed across Bitcoin, Ethereum and Tron.
What “Binance 14” and “Binance 16” mean
Binance 14 and Binance 16 are public labels used by blockchain explorers and analytics services for wallets attributed to Binance. They are labels, not proof of Binance's internal architecture or the exact number of keys involved.
Saying that a labelled wallet is compromised means observers believe unauthorised activity is continuing from that wallet or its authority. Proving that the underlying signing key itself was exposed requires more: signing logs, key-rotation evidence, wallet-system records or a forensic report from Binance.
What remains unconfirmed
- Whether the Binance 14 private key itself was extracted or a signing service was abused.
- Whether Binance 16 shares the same signing infrastructure or was compromised separately.
- Whether EIP-7702 was the initial access path, a secondary technique or a misleading on-chain symptom.
- Which other Binance-labelled wallets remain exposed.
- When the affected authority was revoked or the keys were rotated.
Binance has acknowledged reports of a potential security issue and says user funds are completely safe, but it has not yet identified the attack mechanism.
The evidence that would settle the question
The decisive update would be a Binance post-mortem identifying the affected key-management system, the exact wallets and networks exposed, and the moment the compromised authority was disabled.
Until then, the accurate formulation is: a signing-key compromise is now the leading reported theory, Binance 14 is described as compromised by Solid Intel, and Binance 16 is under suspicion. Binance has not yet confirmed those technical findings.
Read Signal21's complete incident recap and Binance's first direct acknowledgement.
This is a developing story. Signal21 will update the article when Binance or independent forensic teams publish reproducible technical evidence.