Investigation Suggests Binance Hack Relied on Signature Manipulation, Not Key Theft: Insights from Blockaid CEO

Overview of the Binance Hack

Ido Ben-Natan, co-founder and CEO of Blockaid, has suggested that the recent staggering hack of Binance, which resulted in the loss of over $2.5 billion in cryptocurrency, might be attributed to a manipulation of the exchange's transaction-signing framework rather than the theft of its private keys.

Key Insights from Ido Ben-Natan

In an interview with Cointelegraph, Ben-Natan indicated that preliminary evaluations of the incident hint at what he describes as "key misuse." This term refers to methods where attackers exploit or deceive a signing system to authorize fraudulent transactions without necessarily extracting the private keys involved.

According to Ben-Natan's analysis, it appears that the signing infrastructure itself may have been compromised, dismissing the idea that a private key was leaked in the process. This assessment, while preliminary, is informed by Blockaid's insights on similar cyberattacks and the examination of the resulting on-chain activities.

Impact on the Cryptocurrency Market

The specifics of how the hack occurred have not been fully detailed by Binance, but the incident is significant enough to be labeled the largest cryptocurrency theft in history. The aftermath of the breach has already impacted the crypto market; the value of BNB saw a 7% decrease while Bitcoin also experienced declines.

Technical Analysis of the Attack

Blockaid’s analysis indicated that the hackers executed a single transaction that bundled 50 EIP-7702 authorizations, which focused on Binance 14. Notably, one of these authorizations was valid due to a match with the corresponding nonce needed for acceptance. The EIP-7702 standard allows for the delegation of execution to smart contract codes, and Blockaid revealed that the compromised account was related to an unverified sweeper contract. This arrangement permitted an operator to siphon off tokens and Ether from the account.

Ben-Natan mentioned that the complexity of the operation hinted at the potential involvement of several compromised devices within the exchange’s network, although this was yet to be confirmed.

Comparisons to Previous Hacks

When queried about similarities to the Bybit hack from February 2025, Ben-Natan affirmed the parallels, highlighting the sophistication involved. In that instance, attackers had infiltrated the infrastructure by compromising the credentials of a Safe developer, which allowed them to mislead signers into granting their approval for malicious transactions.

Just as in the Bybit case, Ben-Natan suggested that the level of sophistication exhibited in this latest attack bore trademarks commonly associated with North Korean cyber activity, indicating a high level of premeditation and execution in the scheme.