The suspected Binance hack may have involved manipulation of the exchange’s transaction-signing infrastructure rather than theft of private keys, according to Blockaid co-founder and CEO Ido Ben-Natan.
Speaking to Cointelegraph, Ben-Natan said Blockaid’s preliminary assessment points to “key misuse,” a scenario in which attackers trick or compromise a signing system into authorizing malicious transactions without extracting the underlying private key.
“It seems to be… a compromise of signing infrastructure. We don’t think a key was leaked,” he said.
Ben-Natan said the view is still preliminary and is based on Blockaid’s experience with similar attacks as well as its observations of onchain activity.
Binance has not confirmed the exact method that allowed hackers to steal more than $2.5 billion in crypto from the exchange. The report described the incident as the largest crypto hack in history.
Arkham CEO Miguel Morel told Cointelegraph that there is not enough information at this stage to determine whether the attack involved stolen keys or compromised infrastructure.
“From what we can tell, it appears the hack is still ongoing,” he said.
Blockaid flags malicious wallet delegation
In an onchain analysis published on X, Blockaid said the attacker bundled 50 EIP-7702 authorizations into a single transaction targeting Binance 14. One of those authorizations reportedly matched the account’s required nonce, which allowed it to be accepted.
EIP-7702 lets an account delegate execution to smart-contract code. Blockaid said the affected account was delegated to an unverified sweeper contract that allowed a designated operator to drain tokens and Ether.
Ben-Natan told Cointelegraph the operation may have involved multiple compromised devices and movement through the exchange’s network, though that remains unconfirmed.
Comparison with Bybit and North Korea-linked tactics
Asked whether the suspected signing manipulation resembled the February 2025 Bybit attack, Ben-Natan said the two incidents were “very, very similar.”
In the Bybit case, a forensic update published by the exchange said attackers compromised a Safe developer’s credentials, gained access to the wallet provider’s infrastructure and deceived signers into approving a malicious transaction.
Ben-Natan said the Binance activity, like the Bybit case, resembled operations linked to North Korean cyber attackers because of the sophistication of the onchain preparation.
