There are indeed experts who have analyzed how Binance was compromised on the Ethereum chain this time, and I roughly understand it. The vulnerability in Binance lies in the signing step, not the private key. Ethereum has a feature called 7702, which allows a regular wallet to sign an authorization, handing over the management of its account to a contract. It's like writing a power of attorney, authorizing someone else's program to manage your account from today onwards; as soon as money comes in, it transfers it away. After signing, the account no longer belongs to you. This authorization is effective based on a number. Each wallet has a counter called a nonce, which increments by one with each transaction. The authorization is bound to a specific number; it only becomes effective when the account reaches that number, and it expires after one use. The attackers didn't know which number Binance's wallet was at because it was constantly sending transactions. So they made Binance sign 50 consecutively numbered authorizations, one after another, hoping for luck. If just one of the 50 matches the current number, it becomes effective. They succeeded with one. The truly fatal flaw is that these 50... The signatures were made by Binance itself. The consecutive serial numbers on the blockchain indicate that they were signed in batches within a very short period. Blockaid's assessment is that this is more likely a case of key misuse than key theft. The private key is still in Binance's hands, but the attacker tricked the signing system into believing that these 50 signatures were legitimate. Once the authorization took effect, that wallet was no longer a normal wallet. It became the entry point for the attacker's contract, which had only one function: to scan all coins and transfer all ETH, leaving only 1 ETH. Leaving only 1 ETH is to allow the account to continue sending transactions; if someone else deposits money, it will still be scanned. It didn't just steal once, but continuously scanned money. At the same time, Binance's hot wallets on several chains were also flowing out. This shows that the attacker didn't just obtain a single wallet, but a signing capability that could work on multiple wallets simultaneously. In the past decade, exchange thefts have all been due to private key leaks, mnemonic phrase leaks, or insider attacks. This time, nothing was taken; the system itself signed the signatures. 7702 After that, a signature can do far more than a money transfer.