Binance Hack Suspected to Involve Transaction Signing Manipulation

Blockaid's preliminary analysis suggests 'key misuse' where attackers trick or compromise the signing infrastructure to authorize malicious transactions without ever obtaining the private key itself.

Ben-Natan clarified that the evidence points to a compromise of the signing infrastructure rather than a private key leak, based on their experience with similar breaches and blockchain activity observations.

Binance has not disclosed the exact method behind the theft exceeding $2.5 billion in cryptocurrency, marking it as the largest hack in the crypto industry’s history.

Miguel Morel, CEO of Arkham, noted that there currently isn’t enough information to definitively say whether the breach was due to stolen keys or compromised infrastructure.

He also mentioned that, as far as they can tell, the attack may still be ongoing.

Blockaid’s blockchain investigation, shared publicly on X, found that the attacker combined 50 EIP-7702 authorizations into a single transaction aimed at Binance 14, with one authorization matching the required nonce to pass verification.

EIP-7702 enables accounts to delegate execution control to smart contracts; Blockaid explained that the compromised account was delegated to an unverified sweeper contract which allowed an operator to withdraw tokens and Ether.

Ben-Natan indicated to Cointelegraph that the hack might have involved multiple compromised devices and movements within Binance’s network, though these details remain unconfirmed.

When asked if this suspected manipulation resembled the February 2025 Bybit hack, Ben-Natan described the two incidents as very similar.

In the Bybit case, forensic reports indicated attackers gained access by compromising a Safe developer’s credentials, infiltrating wallet provider infrastructure, and tricking signers into approving malicious transactions.

Ben-Natan also remarked that the complexity of the on-chain operations in both attacks is consistent with techniques attributed to North Korean hacker groups.

The significance of this investigation lies in its revelation of sophisticated attack vectors compromising transaction signing infrastructure without leaking private keys, highlighting evolving cyber threats to crypto exchanges.

Blockaid and independent analyses are shedding light on novel methods hackers use, urging enhanced security measures in blockchain transaction authorization.

Understanding these tactics is crucial for the industry’s defense against future breaches, emphasizing the need for robust protection of signing infrastructures.

The Binance hack's scale and method underline the importance of innovation in cybersecurity for cryptocurrency platforms.