Blockaid CEO Points to 'Key Misuse' as Likely Attack Vector
The suspected multi-billion-dollar breach at Binance may not have involved the extraction of private keys at all, according to Ido Ben-Natan, co-founder and chief executive of blockchain security firm Blockaid. In a conversation with Cointelegraph, Ben-Natan explained that his team's preliminary findings suggest the attackers instead manipulated the exchange's transaction-signing infrastructure, coining the term "key misuse" to describe a scenario in which a signing system is tricked or subverted into authorizing fraudulent transfers without the underlying secret key ever leaving its holder's possession.
"It seems to be… a compromise of signing infrastructure. We don't think a key was leaked," Ben-Natan stated, while emphasizing that this remains an early-stage assessment built on Blockaid's experience with comparable attacks and its review of on-chain activity.
Binance itself has yet to disclose the exact technical method that enabled the criminals to siphon more than $2.5 billion in digital assets from the platform — a figure that would make this the single largest cryptocurrency theft ever recorded.
On-Chain Analysis Reveals Clever Use of EIP-7702 Delegation
In an on-chain investigation published on X, Blockaid detailed what it believes happened at the protocol level. The firm said the attacker packed 50 separate EIP-7702 authorization instructions into a single transaction directed at what it identified as Binance 14. Of those 50 bundled authorizations, one reportedly matched the nonce value the account required, which allowed the network to accept and execute it.
EIP-7702 is a protocol upgrade that permits a standard account to delegate its execution rights to smart-contract code. According to Blockaid, the affected account had been delegated to an unverified sweeper contract, which in turn empowered a designated operator to drain both token balances and native Ether from the position.
Ben-Natan told Cointelegraph that the operation may have required access to multiple compromised devices and lateral movement across the exchange's internal network, though he stressed that this scenario has not been independently confirmed.
Uncertainty Remains as Binance and Other Firms Withhold Conclusions
Not all security analysts are ready to commit to a single narrative. Miguel Morel, chief executive of blockchain analytics platform Arkham, told Cointelegraph that the current evidence base is insufficient to determine definitively whether the incident hinged on stolen keys or on compromised signing infrastructure.
That ambiguity underscores the challenges of reconstructing an attack of this scale in real time, particularly when the affected exchange has not yet released a full forensic report.
Echoes of the Bybit Attack and North Korean Ties
When asked whether the suspected signing manipulation bore resemblance to the February 2025 Bybit hack, Ben-Natan was unequivocal, describing the two incidents as "very, very similar."
Bybit's own forensic update at the time revealed that the attackers had compromised the credentials of a Safe developer, gained access to the wallet provider's infrastructure, and then deceived the signers into approving a malicious transaction — a playbook that mirrors the "key misuse" theory now being applied to the Binance case.
Ben-Natan further noted that the sophistication of the on-chain preparations observed in both incidents aligns with the operational patterns previously attributed to North Korean state-sponsored cyber actors, reinforcing the view that these were not opportunistic criminal hacks but rather highly coordinated, well-resourced campaigns.
