Binance, the world’s largest cryptocurrency exchange, is facing renewed scrutiny following a suspected multi-billion-dollar hack that has impacted both digital assets and market sentiment. Wh
Binance, the world’s largest cryptocurrency exchange, is facing renewed scrutiny following a suspected multi-billion-dollar hack that has impacted both digital assets and market sentiment. While the precise method of attack remains unconfirmed by Binance, early assessments from security experts indicate that the breach may have exploited vulnerabilities in the platform’s transaction-signing system rather than directly accessing private keys.
Ido Ben-Natan, co-founder and CEO of Blockaid—a blockchain security company—said his team’s preliminary investigation on the Binance exploit points toward “key misuse” rather than a leaked private key. According to Ben-Natan, attackers apparently convinced or compromised the system responsible for authorizing transactions, enabling malicious transfers without possessing the underlying cryptographic keys themselves.
“It seems to be… a compromise of signing infrastructure. We don’t think a key was leaked,” Ben-Natan stated, highlighting the difference between gaining access to a key versus abusing an internal process for signing transactions.
Blockaid’s review drew from both experience with similar incidents and ongoing analysis of onchain activity. Ben-Natan cautioned that these findings are still preliminary, and that further review may be needed as more information comes to light.
The attack reportedly involved chaining together a set of authorizations using EIP-7702—a recent technical standard. In its public onchain analysis on X, Blockaid explained that the attacker packed 50 EIP-7702 authorizations into a single transaction targeting the Binance 14 wallet. One of these authorizations met the account’s nonce requirement, making it valid and executable.
EIP-7702, an Ethereum improvement proposal, enables an account to delegate transaction execution to smart-contract code. Through this mechanism, the compromised account was assigned to an unverified sweeper contract that allowed a designated operator to remove tokens and Ether.
Mini dictionary: EIP-7702 is an Ethereum protocol upgrade allowing accounts to temporarily act as smart contracts, making transaction authorization more flexible but potentially increasing risk if not implemented securely.
Miguel Morel, CEO of on-chain analytics firm Arkham, commented that there is insufficient evidence at this stage to determine the exact method of attack. He noted the incident appears to be ongoing, with details still emerging.
Blockaid indicated in their X thread that, “the affected account was delegated to an unverified sweeper contract, allowing a designated operator to drain tokens and Ether.”
Ben-Natan told analysts there are parallels between the Binance breach and the February 2025 attack on Bybit. In that earlier case, Bybit reported that attackers compromised the credentials of a wallet provider’s developer, accessed infrastructure, and tricked internal signers into authorizing a fraudulent transaction.
The sophistication of on-chain actions seen in the Binance incident has led Blockaid to draw comparisons with operations previously attributed to North Korean cyber actors. The group’s focus on exploiting advanced technical vulnerabilities for financial gain remains a major concern within the crypto security sector.
Ben-Natan further suggested a possibility of multiple compromised devices and internal movement within the exchange network, though this scenario has not been conclusively documented.
Binance has not released an official statement detailing the exploit’s technical mechanics. However, the incident resulted in the theft of more than $2.5 billion in cryptocurrencies, making it the largest hack of its kind in the industry’s history.
Exchange Year Amount stolen Attack method Binance 2025 $2.5 billion Suspected signing manipulation Bybit 2025 Undisclosed Credential compromiseNews of the exploit triggered sharp volatility across the crypto market. The native Binance token, BNB, declined 7 percent, while Bitcoin registered additional losses as trading sentiment wavered.
Observers warn that the full extent of the breach may only become clear as ongoing investigations progress and more technical findings are made public.
The post Blockaid CEO suggests signing infrastructure flaw in Binance $2.5 billion hack appeared first on COINTURK NEWS.
