Binance Hack Could Stem From Private Key Misuse, Says Blockaid CEO

New details about the suspected scale of Binance’s $2.5 billion+ hack are pointing toward an intrusion path that may not require stealing the exchange’s private keys. Blockaid co-founder and CEO Ido Ben-Natan told Cointelegraph that the early signs resemble “key misuse,” where attackers manipulate or compromise transaction-signing capabilities to authorize harmful transfers.

While Binance has not confirmed the exact mechanism behind the theft—the largest crypto hack on record—Ben-Natan and Arkham CEO Miguel Morel both emphasized that the current picture remains incomplete. Morel said there is not enough information to determine whether the attack involved stolen keys or compromised signing infrastructure, adding that, based on what analysts can see, the incident appears to still be unfolding.

Key takeaways

• Blockaid’s preliminary assessment suggests “key misuse,” implying a signing-system compromise rather than private-key leakage.
• Arkham’s leadership says there isn’t enough evidence yet to confirm whether stolen keys or infrastructure compromise drove the hack.
• Blockaid reports attacker activity involving 50 EIP-7702 authorization delegations bundled into a single transaction.
• The suspected behavior draws parallels to a February 2025 Bybit incident where attackers deceived signers after compromising upstream credentials.

Why analysts think “key misuse” is central

Ben-Natan’s key point was about the difference between extracting secret keys and abusing signing authority. In his view, attackers likely tricked or compromised a signing system so that malicious transactions were authorized without the need to expose the underlying private key material.

“It seems to be… a compromise of signing infrastructure. We don’t think a key was leaked,” Ben-Natan said, noting that the conclusion is provisional. He described Blockaid’s view as based on their experience with similar attacks and their interpretation of onchain behavior.

The distinction matters for investors and ecosystem participants because it changes how teams should think about defense. If signing infrastructure can be manipulated, then key management alone may not be sufficient; organizations may need stronger controls around how authorization workflows, signer prompts, and delegation mechanisms are secured end-to-end.

Blockaid’s onchain findings: EIP-7702 delegation mechanics

Blockaid’s analysis, shared via X, highlights specific onchain patterns tied to the suspected intruder behavior. In one instance described by Blockaid, the attacker bundled 50 EIP-7702 authorizations into a single transaction targeting Binance 14.

EIP-7702 enables an account to delegate execution to smart contract code. Blockaid said one of the authorizations aligned with the account’s expected nonce—an alignment that would make the authorization more likely to be accepted.

In a follow-up note, Blockaid said the affected account was delegated to an unverified sweeper contract. According to Blockaid, this delegation structure allowed a designated operator to drain tokens and Ether from the delegated context.

Ben-Natan told Cointelegraph that the broader operation could have involved multiple compromised devices and movement through Binance’s network, though he stressed that this remains unconfirmed. For readers tracking the case, this suggests the attack may have combined both onchain execution tricks (delegation and operator logic) with offchain access or operational compromise to reach the signing and authorization pathways.

Still unclear: keys vs infrastructure, and the incident may be ongoing

Even with Blockaid’s findings, the precise method remains contested. Binance has not publicly confirmed how attackers accessed funds or what component was compromised.

Arkham CEO Miguel Morel, speaking to Cointelegraph, said the available information is insufficient to confirm whether the hack involved stolen keys or compromised infrastructure. He added that, from what the company can observe, the hack appears to be still ongoing.

This uncertainty is important for market participants: an incident that remains active can continue to produce unpredictable transaction flows and wallet behavior, which complicates analysis, monitoring, and risk assessment.

Similarities to Bybit’s February 2025 incident

Ben-Natan also drew a comparison to a February 2025 Bybit event. Asked whether the suspected signing manipulation resembled the Bybit attack, he said the incidents were “very, very similar.”

In its forensic update released at the time, Bybit said attackers compromised a Safe developer’s credentials, accessed parts of the wallet provider’s infrastructure, and then deceived signers into approving a malicious transaction. The common thread, as Ben-Natan framed it, is a workflow where authorization can be subverted—whether through compromised credentials upstream or by manipulating the signing process itself.

Ben-Natan also suggested that the operation resembles tactics associated with North Korean cyber actors, based on the sophistication of the onchain preparation. That assessment is contextual, not confirmation of attribution, but it indicates analysts see structural similarities in how the attackers positioned authorization mechanisms and execution logic to move funds.

What to watch next

As Binance, security researchers, and monitoring firms continue to refine the attack narrative, the biggest open questions are whether private keys were ever exposed and how exactly the signing and authorization pipeline was manipulated. Until those points are clarified, stakeholders should focus on real-time transaction monitoring, delegation patterns like EIP-7702 usage, and any further evidence about whether the incident is still generating fresh malicious authorizations.