- Blockaid suspects the Binance hack involved signing infrastructure compromise rather than private key theft
- Attackers used EIP-7702 authorization delegation to an unverified sweeper contract
- Over $2.5 billion was stolen in the largest crypto hack in history
- The attack resembles the February 2025 Bybit hack and may involve North Korean actors
Blockaid co-founder and CEO Ido Ben-Natan told Cointelegraph that the suspected multi-billion-dollar Binance hack may have involved attackers manipulating the exchange’s transaction-signing signature rather than stealing private keys. Ben-Natan said Blockaid’s preliminary assessment pointed to “key misuse,” where attackers trick a signing system into authorizing malicious transactions without extracting the underlying private key.
“It seems to be… a compromise of signing infrastructure,” Ben-Natan said. “We don’t think a key was leaked.”
However, Binance has not confirmed the precise method behind the theft of over $2.5 billion, the largest crypto hack in history. Meanwhile, Arkham CEO Miguel Morel told Cointelegraph there isn’t enough information at this point to confirm whether the attack involved stolen keys or compromised infrastructure.
“From what we can tell, it appears the hack is still ongoing,” Morel said. In its onchain analysis published on X, Blockaid said the attacker bundled 50 EIP-7702 authorizations into a single transaction targeting Binance 14.
One authorization reportedly matched the account’s required nonce, allowing it to be accepted. EIP-7702 allows an account to delegate execution to smart-contract code, and Blockaid said the affected account was delegated to an unverified sweeper contract allowing a designated operator to drain tokens and Ether.
Ben-Natan told Cointelegraph the operation could have involved multiple compromised devices and movement through the exchange’s network, though this remains unconfirmed. Asked whether the suspected signing manipulation resembled the February 2025 Bybit attack, Ben-Natan described the incidents as “very, very similar.”
In that case, Bybit’s published forensic update said attackers compromised a Safe developer’s credentials, accessed the wallet provider’s infrastructure and deceived signers into approving a malicious transaction. Like Bybit, Ben-Natan said the activity resembled operations linked to North Korean cyber attackers, based on the sophistication of the onchain preparations.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
