Binance Hack Likely Involves Signing Infrastructure Misuse
Blockaid CEO suggests attackers manipulated transaction signing rather than stealing private keys.
1Preliminary Assessment of Breach
Blockaid CEO Ido Ben-Natan suggests the massive Binance hack, resulting in over $2.5 billion in losses, likely stems from signing infrastructure manipulation. Rather than a direct theft of private keys, the attackers appear to have compromised the system responsible for authorizing transactions, effectively tricking the exchange into signing malicious requests.
2Mechanism of EIP-7702 Exploitation
The attackers utilized a sophisticated method involving 50 bundled EIP-7702 authorizations within a single transaction targeting Binance 14. By matching the account’s required nonce, they successfully delegated execution to an unverified sweeper contract. This specific contract allowed the operator to drain both Ether and various tokens from the compromised account.
3Comparison to Bybit Incident
Experts draw strong parallels between this event and the February 2025 Bybit hack. In the Bybit case, attackers compromised a developer's credentials to access wallet infrastructure, eventually deceiving signers into approving fraudulent transactions. Ben-Natan describes these two incidents as very similar in their operational execution and underlying technical manipulation strategies.
4Ongoing Investigation and Uncertainty
While Blockaid provides a preliminary assessment, Arkham CEO Miguel Morel notes that insufficient data currently exists to definitively confirm the exact attack vector. The situation remains fluid, with reports indicating that the hack may still be ongoing. Binance has yet to issue a formal confirmation regarding the specific method used by attackers.
5Potential North Korean Link
The sophistication observed in the on-chain preparations has led analysts to compare the operation to previous cyberattacks linked to North Korean actors. The methodical approach to moving through the exchange’s network and the precise timing of the transaction authorizations suggest a high level of technical expertise and prior reconnaissance of infrastructure.
6Infrastructure Compromise vs Key Theft
The distinction between key theft and signing infrastructure misuse is critical for security protocols. If private keys remain uncompromised, standard key rotation might not prevent further unauthorized activity. Instead, the focus must shift toward securing the signing environment, verifying developer credentials, and auditing the smart contracts that handle delegated execution permissions.
7Market Impact and Volatility
The news of the breach has significantly impacted crypto markets, contributing to a 7% decline in BNB value and a broader slide in Bitcoin prices. Investors are reacting to the sheer scale of the theft, which represents the largest crypto hack in history, raising concerns about the security of centralized exchange infrastructure.
8Future Security Implications
This incident highlights the inherent risks associated with EIP-7702 and similar delegation mechanisms in high-stakes environments. As exchanges integrate more complex smart-contract features, the attack surface for signing infrastructure expands. Future security audits must prioritize the integrity of these delegation paths to prevent attackers from exploiting authorized, yet malicious, transaction flows.