Binance Hack May Involve Key Misuse, Not Theft: Blockaid

The suspected multi-billion-dollar Binance hack may have involved attackers manipulating the exchange’s transaction-signing signature rather than stealing private keys, according to Blockaid co-founder and CEO Ido Ben-Natan.

Speaking to Cointelegraph, Ben-Natan said Blockaid’s preliminary assessment pointed to “key misuse,” in which attackers trick or compromise a signing system into authorizing malicious transactions without extracting the underlying private key. 

“It seems to be… a compromise of signing infrastructure. We don’t think a key was leaked,” he said.

Ben-Natan said this was a preliminary assessment, drawing on their experience with similar attacks and their observations of the onchain activity.

Binance has not confirmed the precise method that allowed hackers to steal over $2.5 billion in crypto from the exchange — the largest crypto hack in history.

Blockaid identifies malicious wallet delegation

In its onchain analysis published on X, Blockaid said the attacker bundled 50 EIP-7702 authorizations into a single transaction targeting Binance 14. One authorization reportedly matched the account’s required nonce, allowing it to be accepted. 

EIP-7702 allows an account to delegate execution to smart-contract code. Blockaid said the affected account was delegated to an unverified sweeper contract that allowed a designated operator to drain tokens and Ether.

Ben-Natan told Cointelegraph the operation could have involved multiple compromised devices and movement through the exchange’s network, though this remains unconfirmed.

North Korea, Bybit comparison

Asked whether the suspected signing manipulation resembled the February 2025 Bybit attack, Ben-Natan described the incidents as “very, very similar.”

In that case, Bybit’s published forensic update said attackers compromised a Safe developer’s credentials, accessed the wallet provider’s infrastructure and deceived signers into approving a malicious transaction.

Like Bybit, Ben-Natan said the activity resembled operations linked to North Korean cyber attackers, based on the sophistication of the on-chain preparations.