The suspected multi-billion-dollar Binance hack may have involved attackers manipulating the exchanges transaction-signing signature rather than stealing private keys, according to Blockaid co-founder and CEO Ido Ben-Natan.
Speaking to Cointelegraph, Ben-Natan said Blockaids preliminary assessment pointed to “key misuse,” in which attackers trick or compromise a signing system into authorizing malicious transactions without extracting the underlying private key.
“It seems to be… a compromise of signing infrastructure. We dont think a key was leaked,” he said.
Ben-Natan said this was a preliminary assessment, drawing on their experience with similar attacks and their observations of the onchain activity.
Binance has not confirmed the precise method that allowed hackers to steal over $2.5 billion in crypto from the exchange — the largest crypto hack in history.
Arkham CEO Miguel Morel told Cointelegraph there isnt enough information at this point in time to confirm whether the attack involved stolen keys or compromised infrastructure.
“From what we can tell, it appears the hack is still ongoing,” he said.
Related: Binance hack rattles crypto markets as BNB falls 7%, Bitcoin slides
Blockaid identifies malicious wallet delegation
In its onchain analysis published on X, Blockaid said the attacker bundled 50 EIP-7702 authorizations into a single transaction targeting Binance 14. One authorization reportedly matched the accounts required nonce, allowing it to be accepted.
EIP-7702 allows an account to delegate execution to smart-contract code. Blockaid said the affected account was delegated to an unverified sweeper contract that allowed a designated operator to drain tokens and Ether.
Ben-Natan told Cointelegraph the operation could have involved multiple compromised devices and movement through the exchanges network, though this remains unconfirmed.
North Korea, Bybit comparison
Asked whether the suspected signing manipulation resembled the February 2025 Bybit attack, Ben-Natan described the incidents as “very, very similar.”
In that case, Bybit‘s published forensic update said attackers compromised a Safe developer’s credentials, accessed the wallet providers infrastructure and deceived signers into approving a malicious transaction.
Like Bybit, Ben-Natan said the activity resembled operations linked to North Korean cyber attackers, based on the sophistication of the on-chain preparations.