BINANCE $6.3B HACK: WOULD YOUR PERP DEX BE SAFER?

Summary from the TLDR Crypto newsletter

On October 29, a hacked DevOps laptop gave attackers access to Binance's internal signing system, which approved an EIP-7702 delegation handing hot wallet control to the attacker's contract, draining $6.3B with no private key compromise required and $3B since frozen. The same vector cost Bitget $350M a month earlier, both exploiting signing systems configured with blocklists rather than allowlists that permit only known-good transactions. Hyperliquid holds $5.6B of its $6.5B USDC in a Coinbase-controlled treasury address moved by unsigned system transactions, meaning a single key or validator compromise reaches the bulk of user funds. Lighter ($1B, Ethereum) uses ZK proofs to verify withdrawals with a 14-day forced-exit escape hatch, the only DEX among four analyzed where server compromise alone cannot drain balances, though its 4-of-7 security council bypassed upgrade-notice requirements five times in October.