What Happened
Two recent analyses highlight attacks that can bypass familiar security assumptions. A review of Binance’s October 2026 incident reports that attackers used social engineering, an internal AI tool, stolen credentials and access to a wallet-signing service to obtain valid signatures without stealing private keys. An EIP-7702 delegation then gave the attacker persistent wallet authority, including over later deposits [2]. Separately, Unit 42 examined cyberattacks targeting refrigeration systems in Europe and outlined defenses; the available account does not identify the attackers or affected organizations [1].
Why It Matters to Businesses
A valid signature proves that a signing service acted; it does not prove that the requested action was safe. Likewise, an AI tool or operational interface may be trusted inside a workflow while still being misused by someone with stolen access. For wallet operators, monitoring transfers alone can miss a change in authority that enables future transfers [2]. For operators of physical systems, the refrigeration research is a reminder to assess cyber risk in operational environments, not only corporate IT [1].
Kimbodo Engineering Perspective
The common engineering issue is excess authority at a trusted control point. We would treat signing services, AI-assisted workflows and operational-system access as privileged interfaces with explicit limits. That does not mean blocking every automated action: it means separating routine approvals from changes that grant persistent authority, and testing whether safeguards still hold after an operational credential is compromised [2]. The refrigeration account supports reviewing defenses for connected infrastructure, but its limited detail does not justify claims about a particular intrusion path [1].
How We Would Implement It
- Inventory who and what can invoke each signing service or operational control, including internal AI tools and service credentials. Remove unnecessary access and assign an owner for recurring reviews [2].
- Apply transaction-aware signing policies. Treat EIP-7702 delegations and comparable authority changes as administrative actions, with protections that the operational signing key cannot alter [2].
- Alert on changes in wallet authority as well as transfers. Test policies across EIP-7702, Safe modules and ERC-4337 UserOperations, and repeat tests when supported wallets or protocols change [2].
- For connected physical systems, map the paths between business networks, remote access and operational controls, then verify access restrictions, monitoring and recovery procedures against realistic misuse scenarios [1].
Risks, Costs and Security
Stronger approvals add latency and operational work; overly broad alerts create noise. Prioritize persistent authority changes and high-impact operational commands, where a missed event may be more costly than an extra review. Keep independent records of approval requests, policy decisions and resulting authority changes so investigators can distinguish authorized activity from misuse of a trusted service [2].
Where Kimbodo Comes In
Kimbodo builds and operates this in production for businesses — see our AI Security & Guardrails practice, or Request a Security Review.
