After Binance, check what your signing systems can approve

This article examines the October 2026 Binance security incident, in which attackers who compromised a DevOps laptop obtained valid signatures from Binance's wallet-signing service and used an EIP-7702 delegation to authorize repeated transfers without further signatures. It argues that transaction execution and monitoring systems must understand newer Ethereum execution paths such as EIP-7702 delegations, session keys, Safe modules and ERC-4337 UserOperations, and offers a four-step checklist covering reduced signing access, treating delegation as an administrative privilege, limiting damage if signing is compromised, and detecting changes in wallet authority.