Blockaid co-founder and CEO Ido Ben-Natan said the suspected hack of Binance may have involved misuse of transaction-signing infrastructure rather than theft of private keys, according to comments to Cointelegraph.
Ben-Natan said Blockaid’s preliminary assessment pointed to “key misuse,” in which attackers trick or compromise a signing system into authorizing malicious transactions without extracting the underlying private key. “It seems to be… a compromise of signing infrastructure. We don’t think a key was leaked,” he said.
He described the assessment as preliminary and said it drew on Blockaid’s experience with similar attacks and its observations of onchain activity. Binance has not confirmed the precise method used to steal more than $2.5 billion in crypto, the largest crypto hack in history.
Blockaid identifies malicious wallet delegation
In onchain analysis published on X, Blockaid said the attacker bundled 50 EIP-7702 authorizations into a single transaction targeting Binance 14. One authorization reportedly matched the account’s required nonce, allowing it to be accepted.
EIP-7702 allows an account to delegate execution to smart-contract code. Blockaid said the affected account was delegated to an unverified sweeper contract that allowed a designated operator to drain tokens and Ether.
Ben-Natan told Cointelegraph the operation could have involved multiple compromised devices and movement through the exchange’s network, though that remains unconfirmed.
Comparison with Bybit attack
Asked whether the suspected signing manipulation resembled the February 2025 Bybit attack, Ben-Natan described the incidents as “very, very similar.”
In that case, Bybit’s published forensic update said attackers compromised a Safe developer’s credentials, accessed the wallet provider’s infrastructure and deceived signers into approving a malicious transaction.
Ben-Natan said the activity resembled operations linked to North Korean cyber attackers, based on the sophistication of the onchain preparations. He did not present that link as confirmed.
