An exchange hack on Binance may involve the “abuse” of private keys rather than theft: Blockaid
Blockaid's Ido Ben - Natan suggests that attackers manipulated the trading signature infrastructure of Binance, a judgment that bears similarities to the Bybit hacking incident.
According to Blockaid, co-founder and CEO Ido Ben - Natan, the multi-billion-dollar hacker attack suspected to target Binance may involve the attackers manipulating the exchange's transaction signature mechanism, rather than stealing private keys.
In an interview with Cointelegraph, Ben-Natan stated that the preliminary assessment of Blockaid pointed towards "key abuse" ( key misuse ), which means that attackers trick or break into the signing system to authorize malicious transactions without extracting the underlying private keys.
"It seems... that the signature infrastructure has been compromised. We do not believe there has been any key leakage," he said.
Ben-Natan indicates that this is merely a preliminary judgment, based on their experience with similar attacks and their observation of activities on the blockchain.
Binance has not yet confirmed exactly how hackers stole over $2.5 billion in crypto assets from the exchange – this is the largest crypto hacking incident in history.
Arkham CEO Miguel Morel told Cointelegraph that the current information is not sufficient to determine whether this attack involves stolen keys or compromised infrastructure.
"From what we can see so far, it seems that this hacking incident is still ongoing," he said.
Relevant reports: The Binance hack incident impacts the crypto market, BNB drops by 7%, Bitcoin recovers
Blockaid identifies malicious wallet commissions
In their analysis published on X, Blockaid indicated that the attacker packaged 50 EIP-7702 authorizations into a single transaction, targeting Binance 14. One of these authorizations was reportedly matched with the nonce required by that account, and therefore was accepted.
EIP-7702 Allows accounts to delegate execution permissions to smart contract code. Blockaid Indicates that the affected account has been delegated to an unverified sweeper contract, which allows the designated operator to empty tokens and Ether.
Ben-Natan told Cointelegraph that this operation may involve multiple compromised devices and movements within the exchange network, but this has not yet been confirmed.
North Korea, Bybit comparison
When asked whether this suspected signature manipulation was similar to the Bybit attack in February 2025, Ben-Natan stated that the two incidents were "very, very similar."
In that incident, an evidence update published by Bybit stated that the attacker breached the credentials of a developer from Safe, accessed the infrastructure of the wallet provider, and deceived signatories into approving a malicious transaction.
Ben-Natan says that, considering the complexity of the preparatory work on the blockchain, such activities are also similar to those associated with North Korean cyber attackers.
Magazine: Singapore reported about the tampered Ledger: Asia Express a month before the information was exposed.
