Binance hack may involve private key ‘misuse,’ not theft: Blockaid CEO
Blockaid’s Ido Ben-Natan suspects attackers manipulated Binance’s transaction-signing infrastructure, drawing parallels with the Bybit hack.
Blockaid's CEO Ido Ben-Natan suggests the massive Binance cryptocurrency heist may not be the result of a stolen private key, but rather a manipulation of the exchange's transaction-signing system. Speaking to Cointelegraph, Ben-Natan stated that their initial findings indicate "key misuse," where attackers may have compromised the signing infrastructure, tricking it into approving unauthorized transactions without actually stealing the private keys.
Ben-Natan added that this assessment is still preliminary, based on their experience with similar attacks and on-chain analysis. Unfortunately, Binance has not yet provided an official explanation for the $2.5 billion crypto robbery, which is the largest heist in the history of digital currencies. Similarly to Arkham's CEO Miguel Morel, Ben-Natan also noted there is not enough information to determine whether the attack involved stolen keys or compromised infrastructure.
He also mentioned that the hack might still be ongoing. According to Blockaid's on-chain analysis published on X, the attacker executed a single transaction bundling 50 EIP-7702 authorizations, with one authorization matching the account's required nonce and successfully bypassing the transaction-signing process. The targeted account was reportedly delegated to an unverified sweeper contract, which enabled the attacker to drain tokens and Ether.
Ben-Natan commented that the operation might have involved multiple compromised devices and movement through Binance's network, although this remains unconfirmed. When asked about the similarities between the Binance hack and the February 2025 Bybit incident, Ben-Natan described them as "very, very similar". In the Bybit case, the attackers reportedly gained access to the wallet provider's infrastructure and deceived signers into approving a malicious transaction after compromising the Safe developer's credentials.
Based on the complexity of the on-chain preparations, Ben-Natan believes both incidents resemble operations linked to North Korean cyber attackers.
Written by urgent.news from Cointelegraph's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
