In this Binance security incident, I think there's a detail more worthy of consideration than the transfer of billions of dollars in assets. The private key wasn't confirmed to have been leaked, yet the attackers were able to complete the asset transfer. How did they manage that? Simply put, this incident may have exposed a problem that many people easily overlook: the biggest security vulnerability in exchanges isn't necessarily in the wallet, but may lie outside of it. According to Binance's initial disclosure, the attack may have started with the compromise of a DevOps engineer's laptop, subsequently affecting internal service containers and withdrawal processes. GCSA subsequently conducted an on-chain forensics review, verifying 18 original transactions, 50 initial authorization signatures for EIP-7702, and 1 revocation signature. A technical detail worth noting here is that a Type-4 transaction can accommodate 50 authorizations, but that doesn't mean all 50 authorizations are valid. A valid signature doesn't necessarily mean the private key has been stolen. The report also tracked three consecutive transactions associated with MetaMask Gas Station, finding that the initial ETH deposit amount precisely matched the maximum gas budget of the subsequent two transactions. As for claims that the attacker mistakenly selected USDT or that MetaMask possessed the real IP address, there is currently insufficient evidence to support these claims. TRM Labs has linked the incident with a high degree of confidence to TraderTraitor, a North Korean-related threat organization, but this does not equate to a complete reconstruction of the attacker's identity and operational path. I've always believed that exchange security cannot solely focus on cold wallets, multi-signature, and private keys. Employee computers, internal permissions, DevOps environments, signature services, withdrawal approvals, and even third-party infrastructure—a breach in any of these areas can render the asset security system ineffective. Furthermore, the estimated impact of the incident at approximately $6.3 billion does not equate to the final net loss, and freezing assets does not guarantee recovery. What the entire industry should truly reflect upon in this incident is that when attackers can still access assets without directly obtaining private keys, our past understanding of exchange security boundaries may no longer be sufficient.