S2W assesses the October 29 Binance hot-wallet compromise, which resulted in USD 6.3-6.4 billion in losses across at least 10 blockchains, as an operation by the DPRK-backed TraderTraitor group. The report says attackers used EIP-7702 delegated authorization to execute a sweeper contract on compromised hot wallets, repeatedly moving incoming assets while delegation remained active, and abused execution authority to withdraw an additional USD 823 million in USDC. It recommends monitoring high-volume multi-chain withdrawals, consecutive-nonce delegation requests, delegated-code changes, signing-service transaction parameters, and DevOps access or container activity.