According to Ido Ben-Natan, co-founder and CEO of Blockaid, attackers in the alleged multi-billion dollar Binance hack may have manipulated the exchange’s transaction signature.
Speaking to Cointelegraph, Ben-Natan said Blockaid’s preliminary assessment points to “key abuse,” where attackers trick or compromise a signature system to authorize malicious transactions without extracting the underlying private key.
“It appears to be … a compromise of the signing infrastructure. We do not believe a key was leaked,” he said.
Ben-Natan said this was a preliminary assessment based on their experience with similar attacks and their observations of on-chain activity.
Binance has not confirmed the exact method that allowed hackers to steal over $2.5 billion worth of cryptocurrencies from the exchange – the largest crypto hack in history.
Arkham CEO Miguel Morel told Cointelegraph that there is not enough information at this time to confirm whether the attack involved stolen keys or compromised infrastructure.
“As far as we can tell, the hack appears to be still ongoing,” he said.
Related: Binance hack shakes crypto markets: BNB falls 7%, Bitcoin slides
Blockaid identifies malicious wallet delegation
In its on-chain analysis published on
EIP-7702 allows an account to delegate execution to smart contract code. blockade said the affected account was delegated to an unverified sweeper contract that allowed a specific operator to siphon off tokens and Ether.
Ben-Natan told Cointelegraph that the operation may have involved multiple compromised devices and movements through the exchange’s network, although this remains unconfirmed.
North Korea, Bybit comparison
When asked whether the alleged signature manipulation was similar to the February 2025 Bybit attack, Ben-Natan described the incidents as “very, very similar.”
In this case Bybit’s released forensic update The attackers compromised a safe developer’s credentials, accessed the wallet provider’s infrastructure and tricked signatories into approving a malicious transaction.
Like Bybit, Ben-Natan said the activity resembled operations related to North Korean cyber attackers based on the sophistication of on-chain preparations.
Magazine: A month before the news broke, a manipulated ledger was reported in Singapore: Asia Express
