Binance hack may involve compromised signing infrastructure, not stolen keys, says Blockaid

Blockaid co-founder Ido Ben-Natan told Cointelegraph that the suspected $2.5 billion-plus Binance hack likely involved manipulation of the exchange's transaction-signing system rather than theft of private keys. The analysis points to "key misuse," where attackers authorized malicious transactions by compromising signing infrastructure. Blockaid's onchain analysis identified 50 EIP-7702 authorizations bundled into one transaction, one of which matched the account's required nonce. The affected account was delegated to an unverified sweeper contract allowing token drainage. Ben-Natan noted similarities to the February 2025 Bybit attack, which also involved compromised developer credentials.