AI disclosure: drafted by Basis Desk's AI newsroom and machine-checked against the primary sources listed below — how we use AI. Originally published on Basis Desk.
Preliminary analysis suggests attackers manipulated signing infrastructure through EIP-7702 delegation rather than exfiltrating private keys directly.
Key points
- Blockaid assessed the $2.5 billion Binance breach as signing infrastructure misuse rather than a direct private key theft.
- The attacker bundled 50 EIP-7702 authorizations into one transaction targeting Binance 14, delegating control to a sweeper contract.
- Blockaid noted operational similarities to the February 2025 Bybit exploit and tactics linked to North Korean cyber operators.
Attackers who stole over $2.5 billion from cryptocurrency exchange Binance may have compromised its transaction-signing infrastructure rather than exfiltrating underlying private keys, according to security firm Blockaid [1]. The incident represents the largest cryptocurrency theft recorded to date [1]. At the time of writing, $BTC traded at $77,467, down 4.6% over the prior 24 hours, while $ETH fell 5.1% to $2,235 amid broader market turbulence.
In a preliminary assessment, Blockaid co-founder and CEO Ido Ben-Natan stated that the breach pointed toward "key misuse" [1]. Under this vector, attackers manipulate an account or its signing environment into executing unauthorized transfers without directly stealing the private key itself [1]. Ben-Natan noted that the operation could have involved multiple compromised internal devices and lateral movement through Binance's network, although those details remain unconfirmed [1]. Binance has not officially confirmed the specific mechanism used to carry out the exploit [1].
Technical Vectors and Bybit Parallels
On-chain analysis published by Blockaid indicated that the attacker batched 50 EIP-7702 authorizations into a single transaction aimed at a Binance account labeled Binance 14 [1]. EIP-7702 enables an externally owned account to delegate execution authority to smart contract code [1]. One of the bundled authorizations matched the target account's required nonce, enabling acceptance and delegating the wallet to an unverified sweeper contract that allowed an operator to drain tokens and $ETH [1].
Ben-Natan described the incident as "very, very similar" to the February 2025 attack on Bybit, in which attackers breached developer credentials at wallet provider Safe to deceive signing systems into approving malicious transactions [1]. The sophistication of the on-chain preparations led Blockaid to observe similarities to campaigns typically associated with North Korean cyber operations [1]. The investigation follows previous industry research where Blockaid finds hackers hold $287 million in stolen crypto beyond freezing reach, demonstrating persistent hurdles in asset recovery after multi-signature and custodial breaches.
Sources
- Binance hack may involve private key ‘misuse,’ not theft: Blockaid CEO — Primary document (discovered)
Basis Desk is a source-verified crypto newsroom. Market data, a free MCP server for AI agents and JSON APIs: basisdesk.news/developers. Not investment advice.
Top comments (0)