Binance’s $2.5B Hack: The Key May Have Stayed Put 🔑

The suspected theft of more than $2.5 billion in crypto from Binance may have resulted from attackers manipulating the exchange’s transaction-signing signature rather than obtaining its private keys, according to Blockaid co-founder and CEO Ido Ben-Natan. The incident would be the largest crypto hack in history, but Binance has not confirmed the precise method used to move the funds.

Ben-Natan said Blockaid’s preliminary assessment, based on experience with similar attacks and observations of onchain activity, pointed to “key misuse,” in which attackers trick or compromise a signing system into authorizing malicious transactions without extracting the underlying private key. “It seems to be… a compromise of signing infrastructure. We don’t think a key was leaked,” he said.

Blockaid’s onchain analysis published on X identified a transaction that bundled 50 EIP-7702 authorizations and targeted Binance 14. One authorization reportedly matched the account’s required nonce, allowing it to be accepted. EIP-7702 permits an account to delegate execution to smart-contract code, and Blockaid said the affected account was delegated to an unverified sweeper contract capable of allowing a designated operator to drain tokens and Ether.

Ben-Natan said the operation could have involved multiple compromised devices and movement through Binance’s network, although that has not been confirmed. He described the activity as “very, very similar” to the February 2025 Bybit attack, in which attackers compromised a Safe developer’s credentials, accessed the wallet provider’s infrastructure and deceived signers into approving a malicious transaction. Based on the sophistication of the onchain preparations, Ben-Natan said the Binance activity resembled operations linked to North Korean cyber attackers.

The hack rattled crypto markets, with BNB falling 7% and $BTC sliding. Separately, Asia Express reported in its magazine that Tampered Ledger had been reported in Singapore a month before the news broke.