Beyond Private Keys: The Human Layer of Security
Why identification, authentication, and authorisation now define real control in the digital asset era.
By Jenny Tseliou, Serenity Technology
The theft began with a job offer. In September 2026 someone posing as a project director approached a Binance engineer on a job-hunting platform. There was a live video interview with a fake HR representative, then a conversation with a fake CEO, who set a take-home assignment. The assignment contained malware, and it ran on a work computer, The Register reported from Binance’s account.
On October 29, stolen credentials were used to deploy a container and reach an internal wallet signing service. Within hours, Binance says, approximately $6.34 billion in digital assets had been taken. The FBI attributes the attack to North Korea. Binance’s report does not describe a stolen private key. Its hot wallet used multi-party computation, so there was “no single private key” at all, a detail it mentions only because that made the malicious permissions harder to revoke.
Digital asset security now rests on three separate questions: identification (who is claiming to act), authentication (can that claim be proven) and authorisation (should this specific action go ahead). Binance’s report on the $6.34 billion theft of October 2026 points to weaknesses around all three: fake recruiters, stolen tokens and a signing service reached outside the normal withdrawal process.
For years this industry has given one piece of security advice: protect the key. It remains good advice. But the most expensive theft in crypto’s history was carried out around the key, through the people and permissions that surround it.
identification: who is claiming to act
Identification is the moment a name is presented. A username, a wallet address, a role in a directory, a face on a video call. It is a claim, and everything downstream inherits whatever trust that claim was given.
The Binance engineer identified a CEO from a chat window. Binance’s internal systems then identified engineers from their tokens and sessions. Both were labels, and both were false in the moment that mattered.
NIST’s digital identity guidelines treat this as a distinct step: before anything can be verified, a provider must resolve the user, meaning uniquely distinguish that person from everyone else. Most organisations do this once, at hiring or onboarding, and approximate it for years afterwards. A wallet address has the same limit. It identifies a key, and it has never identified a person.
authentication: proving the person, not the token
Authentication tests the claim. The weakness is in what gets tested. Passwords, one-time codes and session tokens prove that someone holds a secret, and secrets can be copied. In the Binance case a container deployment token sat on an engineer’s machine. Whoever held it could use it.
Binance had already caught one intrusion. In June an engineer installed a tampered Homebrew package, and the company replaced the device and rotated the credentials. That is the correct response to a credential problem, and the attacker came back through a different engineer three months later. Rotating secrets replaces what was stolen. It does not change the fact that a secret on a compromised computer proves very little about who is using it.
Stronger authentication moves the proof off the computer that might be compromised and ties it to something that cannot be copied over a network: a physical object and the person holding it.
authorisation: approving the action, not the session
Authorisation is the question most systems skip. A login tells a system who is present. It says nothing about whether this payment, to this address, for this amount, should happen.
Binance says the attackers used the signing service to start transactions outside the normal withdrawal process, then used 50 signing transactions and an Ethereum feature called EIP-7702 to delegate execution rights over a hot wallet to a contract they controlled. EIP-7702, in Binance’s words, lets an account delegate rights “without exposing the private key.” The first large transfer left at 20:05 UTC. The delegation was cleared at 00:10. Binance has not yet explained how its multi-party approval was circumvented, and its investigation continues.
Get Serenity Technology’s stories in your inbox
Join Medium for free to get updates from this writer.
The standards world has been working on a narrower kind of permission for some time. RFC 9396, Rich Authorization Requests, published by the IETF in 2023, replaces a broad permission such as “payments” with a structured description of one action. Its own example is a client asking to transfer 45 euros to Merchant A. The person approves that transfer, and nothing else.
what AI changes about all three
Binance says the attackers used a compromised machine and an internal AI tool to gain control over two wallet engineers. That is one incident, but it shows the direction of the pressure. AI tools inside a company hold real access, as we saw in the sandbox incidents. Outside the company, generative models make fake recruiters, voices and faces cheap to produce.
Each of these attacks identification first. A model can imitate how a CEO writes, speaks and looks on a video call. An agent can hold a valid token and act at machine speed. What neither can do is place a finger on a sensor in another city. AI resilience, in practice, means anchoring the decisions that matter in something physical, so that a perfect imitation on a screen still has nothing to press.
what quantum resilience means for authorisation
In March 2026 researchers at Google Quantum AI, with Justin Drake and Dan Boneh among the co-authors, estimated that the 256-bit elliptic curve problem behind most crypto signatures could be solved in minutes using fewer than half a million physical qubits. No such machine exists. On October 27, NIST finalised its transition report: it will deprecate quantum-vulnerable public-key cryptography after 2030 and disallow it after 2035, and the US government’s most sensitive systems must adopt post-quantum signatures by December 31, 2031.
A fingerprint and a signature face that threat very differently. A quantum computer attacks the mathematics of public-key cryptography. It has no special power against a fingerprint template that sits on a card and exists in no central database, because there is nothing to intercept and store for later. The signature that carries the approval is another matter, because it is public-key cryptography. NIST notes that signatures are not exposed to harvest-now-decrypt-later attacks, which buys time, but an approval system still has to be able to change its algorithms without rebuilding how people approve things. Quantum resilience is that ability to migrate, and it has to be designed in.
three questions, one physical answer
These three questions, under pressure from AI and quantum computing, are what sAxess Pro was built to separate. sAxess Pro is Serenity Technology’s biometric access control card for organisations. It replaces passwords, SMS codes and PINs with a fingerprint checked on the card, so every sensitive approval is tied to a named person and recorded in an audit trail. Identification is anchored at enrolment, when a person’s fingerprint is bound to one specific card, with the template stored on that card and no central biometric database to breach. Authentication is a fingerprint match inside the card’s secure element, physically separate from the phone or laptop that might be compromised. Authorisation follows a three-layer model the technical whitepaper calls Request, Approval and Proof: the request states the action, resource and context using Rich Authorization Requests, the person approves on the card, and the signed response is evidence of who approved what. The same flow covers machine-initiated work, so an AI agent can raise a request while the approval comes from a person’s card.
The limits are as important as the design. On quantum, the accurate word today is ready, not resistant. The card signs with elliptic-curve cryptography, the family NIST is phasing out, and what Serenity’s whitepaper describes is a path: IDEMIA’s Sphere HSM, built on the same secure element foundation, is designed for crypto-agility and migration to post-quantum algorithms. On AI, a card does not stop a person from being deceived into approving a request they should have refused, although showing the exact action makes that harder. A determined attacker who physically holds the card and a good replica of the fingerprint is a threat the sensor has to withstand on its own. And no approval step protects a path that does not go through it. The Binance attackers reached a signing service outside the normal withdrawal process, and any control that can be routed around is a control in name only.
the question the signatures could not answer
Binance eventually cleared the malicious delegation by building a revocation procedure under pressure, because there was no single key to reach for. The signatures on those transactions were valid. The wallet did what valid signatures told it to do.
What the chain could not record that night was a person. Every system involved knew which credential had acted. The question private keys were never built to answer is whether anyone with the right to decide had decided.
Jenny Tseliou is a contributor at Serenity Technology, covering digital asset security, identity, and access control. Serenity Technology (s.technology, formerly Serenity Shield) builds biometric security and recovery infrastructure for digital assets, including sAxess Pro, a biometric access control card for organizations.
Related reading: Serenity Presents: sAxess Pro | Why Biometric Hardware Is Becoming the New Standard for Institutional Crypto Compliance | When AI Escapes the Sandbox.
Common questions
What is the difference between identification, authentication and authorisation? Identification is the claim of who someone is, such as a username or wallet address. Authentication is the proof of that claim, such as a password, a security key or a fingerprint. Authorisation, spelled authorization in American English, is the decision about what that person may do, such as approving one specific payment. The three are often merged into a single login, which is why a stolen session can pass for a legitimate approval.
How did the $6.34 billion Binance hack happen? According to Binance, attackers linked by the FBI to North Korea approached engineers through fake job interviews, planted malware on work computers and used an internal AI tool to reach wallet engineers. On October 29, 2026, stolen credentials gave them access to an internal wallet signing service, and they used EIP-7702 delegation to gain execution rights over hot wallets. Binance says about $2.85 billion has been frozen or intercepted. The investigation is ongoing.
Is biometric authentication quantum resistant? Partly. A fingerprint match stored and performed on a card is not the kind of public-key mathematics a quantum computer attacks, and a template that stays on a card offers nothing to intercept. The digital signature that carries the approval usually is public-key cryptography, so it needs migrating to post-quantum algorithms. sAxess Pro, for example, signs with elliptic-curve cryptography today, and its whitepaper describes crypto-agile infrastructure as the migration path.
How can organisations stop a valid login from approving a fraudulent transaction? Several controls are used together. Policy engines in custody platforms such as Fireblocks and Copper limit what any single approval can do. Hardware security keys such as YubiKey move authentication off the computer. Rich Authorization Requests make each approval describe one specific action. Multi-person approval rules require a second reviewer above set thresholds. Biometric cards such as sAxess Pro from Serenity Technology tie each approval to a fingerprint checked on the card. Each control works only if the sensitive path cannot be routed around it.
How does sAxess Pro handle identification, authentication and authorisation? sAxess Pro is Serenity Technology’s biometric access control card for organisations, not a crypto wallet. Identification is anchored when a person enrols their fingerprint on a specific card. Authentication happens through a fingerprint match inside the card’s secure element. Authorisation uses a Request, Approval and Proof model, in which the person approves a specific action, resource and context, and the signed result is recorded as evidence of who approved what.
