Blockaid Weighs Signing Misuse in Binance’s $2.5 Billion Hack

By Nathan Brooks

Attackers stole more than $2.5 billion from Binance in the crypto industry’s largest reported hack, according to Cointelegraph, while the exchange has not confirmed how the attackers obtained transaction authorization.

Blockaid co-founder and CEO Ido Ben-Natan told Cointelegraph that the company’s preliminary assessment points to key misuse, in which an attacker tricks or compromises a signing system into approving malicious transactions without extracting the underlying private key. “It seems to be… a compromise of signing infrastructure,” he said. Ben-Natan does not believe a key leaked.

The assessment narrows the incident’s initial technical question. It moves attention away from the binary status of a private key and toward the systems that construct, present and authorize transactions. Ben-Natan said Blockaid based the assessment on experience with similar attacks and observations of on-chain activity, not on a final forensic finding from Binance.

What did Blockaid find on-chain?

Blockaid published an on-chain analysis on X in which it said the attacker bundled 50 EIP-7702 authorizations into a single transaction targeting Binance 14. One authorization reportedly matched the account’s required nonce; Blockaid said that match enabled acceptance.

EIP-7702 allows an account to delegate execution to smart-contract code. Blockaid said the affected account delegated execution to an unverified sweeper contract. That contract gave a designated operator the ability to drain tokens and Ether from the account.

The distinction is operational rather than semantic. An attacker can leave the underlying private key inaccessible while a compromised signing path still produces an approval that a system accepts. Under Ben-Natan’s hypothesis, investigators would need to test signer controls and transaction construction before identifying a breach of those systems.

Ben-Natan said the operation could have involved multiple compromised devices and movement through the exchange’s network. He emphasized that possibility remains unconfirmed. The on-chain evidence supports a narrower claim than a complete intrusion narrative: Blockaid identified a concentrated authorization structure and an accepted delegation, while the route into the signing environment remains open.

How does the Bybit comparison matter?

Asked whether the suspected manipulation resembled the February 2025 Bybit attack, Ben-Natan called the incidents “very, very similar.” Bybit’s published forensic update said attackers in that case compromised a Safe developer’s credentials, accessed the wallet provider’s infrastructure and deceived signers into approving a malicious transaction.

The comparison does not establish the same attacker or identical mechanics. It does provide a documented precedent for abusing trusted signing infrastructure without necessarily taking control of the signing key itself. That distinction changes where investigators and exchange operators place their first questions: device access, credential controls and the path between a proposed transaction and a signed authorization.

Ben-Natan also said the on-chain preparations resembled operations linked to North Korean cyber attackers, based on their sophistication. He did not present that assessment as confirmed attribution to North Korea, and the available information does not establish that identity.

What does this change for Binance and its users?

For Binance, the preliminary theory changes the first operational response from assuming a leaked key to testing whether a signing system was manipulated. For counterparties, liquidity providers and traders, it means the absence of a confirmed private-key leak would not, by itself, explain the $2.5 billion loss or identify who controlled the approvals.

The immediate evidence still has limits. A related Cointelegraph report said the hack rattled crypto markets, with BNB falling 7% and Bitcoin sliding, but Binance has not confirmed the precise intrusion method, and Blockaid has not published a timing or attribution for the suspected compromise. Until Binance or investigators validate the mechanism, EIP-7702 account delegation remains the market-structure change under most scrutiny, while the North Korean connection remains unconfirmed.