Security · Control and intermediaries
Why Funds Kept Leaving Binance After Withdrawals Were Suspended
A stop button seems straightforward: press it, and movement stops. In a distributed system, that may be only one part of the emergency procedure.
EDITORIAL OVERVIEW · Prepared by the project editors from the sources listed below.
Stopping a service does not revoke a permission
Binance says that suspending withdrawals did not revoke permissions already in place on Ethereum. Those permissions operated independently of the exchange’s normal infrastructure. Revoking them required additional transactions; the company also points to complications associated with its use of multi-party computation, or MPC, for signing.
To understand the difference, it helps to distinguish the website from the blockchain itself. An operator can stop accepting requests and shut down its software. That does not automatically erase changes already recorded on the network.
Permissions that persist
Ethereum’s EIP-7702 mechanism allows an ordinary account to use the code of a selected smart contract. Once established, the delegation persists rather than disappearing after a single transaction. Such an authorisation therefore cannot be understood simply as consent to a one-off transfer. Its consequences depend on how the delegated code works.
The mechanism has legitimate uses: combining several actions, allowing another participant to pay transaction fees and adding wallet capabilities. The fact that it was used during a theft does not, by itself, prove a flaw in Ethereum’s rules.
This concerns the Ethereum part of the incident specifically. The explanation must not be applied to the stolen BTC or presented as a feature of Bitcoin.
What the emergency stop covers
Our editorial question for the forthcoming independent review is what, exactly, the emergency stop covered. Only the exchange’s own services? Permissions already granted? Transactions awaiting execution?
An emergency stop must be assessed by more than an interface going dark. It is necessary to understand which actions remain possible after the stop.
Sources and verification
Information checked November 4, 2026. The account of the incident response is based on Binance’s preliminary report. EIP-7702 concerns Ethereum; the mechanism described must not be applied to Bitcoin. The editorial questions are not established findings of wrongdoing.
Unless stated otherwise, the text, conclusions, structure and editorial arrangement were created by the project editors. Facts, quotations and source materials remain attributable to their authors and rights holders.
← Back to the rubric