Blockaid CEO Suggests Binance Hack Involved Transaction-Signing Manipulation
Investigation suggests Binance hack used transaction-signing manipulation
Ido Ben-Natan, the CEO of security firm Blockaid, suggests that the massive drain of funds from Binance likely involved "key misuse" rather than the theft of private keys. A private key is a secret code used to authorize transactions and control a crypto wallet. Ben-Natan believes attackers manipulated the systems used to sign transactions, tricking them into authorizing the movement of funds without ever having the actual keys.
This incident has resulted in the loss of over $2.5 billion, making it the largest crypto hack in history. Binance, a crypto exchange where users buy and sell digital assets, has not yet confirmed the exact method used by the attackers.
Important details from the preliminary assessment
- Blockaid suspects the exchange's transaction-signing infrastructure was compromised to allow malicious transfers.
- The attackers may have used a technical standard called EIP-7702 to bundle 50 unauthorized authorizations into a single transaction.
- These authorizations pointed a Binance account toward a "sweeper contract," which is an automated program designed to drain tokens and Ether.
- The operation may have involved multiple compromised devices and movement through the exchange's internal network.
Blockaid CEO compares incident to previous exploits
Ben-Natan noted that the activity is "very, very similar" to an attack on the Bybit exchange in February 2025. In that case, attackers used stolen developer credentials to access security infrastructure and deceive signers into approving theft. Based on the sophistication of the on-chain preparation, Ben-Natan added that the operation resembles tactics often linked to cyber attackers from North Korea.
What is known about the $2.5 billion loss
It is confirmed that a massive amount of cryptocurrency has been drained from Binance. Blockaid’s analysis shows that the attackers used bundled authorizations to target a specific wallet known as Binance 14. One of these authorizations matched a required security number, or nonce, which allowed the transaction to be accepted by the network.
Uncertainty remains over the technical cause
Despite the analysis from Blockaid, other experts say it is too early to be certain. Arkham CEO Miguel Morel stated there is not enough information to confirm if the attack involved compromised infrastructure or if private keys were actually stolen. Morel also noted that the hack appeared to be ongoing at the time of his assessment. Binance has not yet provided a final technical report on how the security breach occurred.
Why the method of the attack matters for security
Understanding the difference between stolen keys and manipulated infrastructure is vital for the safety of digital assets. If attackers can bypass security by tricking the signing systems themselves, it highlights a vulnerability that goes beyond simple key protection. It also shows the potential risks of using automated programs, or smart contracts, to manage large amounts of user funds.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.
Related Posts
Norway Moves to Regulate 'Pervert Glasses' and Considers Facial Recognition Ban
Moonflower Coffee and 300+ Colorado Merchants Now Accept Bitcoin
