The Binance security incident in October 2026 highlighted a critical vulnerability: organizations must detect when a valid signature grants an attacker wallet authority, not just monitor transfers. Binance's investigation revealed a complex attack involving social engineering, AI tool misuse, stolen credentials, and unauthorized access to its wallet-signing service. Despite not leaking private keys, the attacker obtained valid signatures, demonstrating the risk of a compromised server misusing a protected key. The attacker exploited an EIP-7702 delegation, allowing repeated transfers without further Binance signatures, including funds deposited post-initial theft. Other wallets were drained using ordinary signed transfers. Transaction execution and monitoring systems must adapt to new Ethereum features like EIP-7702, session keys, and ERC-4337, which introduce alternative execution paths that need to be understood by signing policies and monitors. The text provides four key recommendations for strengthening wallet security: reducing access to signing infrastructure, treating delegation as an administrative privilege, limiting damage even if signing is compromised, and detecting changes in wallet authority. These recommendations include specific verification steps to ensure controls are effective. Organizations are urged to document services requesting signatures, reject unauthorized delegations, implement separate custody controls for assets, and map wallet authorities to assets and contracts. Continuous review and testing of signing infrastructure are crucial, especially with changes in supported protocols, wallets, or signing services.