Binance hack may involve private key ‘misuse,’ not theft: Blockaid CEO

The suspected multi-billion-dollar Binance hack may have involved attackers manipulating the exchange’s transaction-signing signature rather than stealing private keys, according to Blockaid co-founder and CEO Ido Ben-Natan.

Speaking to Cointelegraph, Ben-Natan said Blockaid’s preliminary assessment pointed to “key misuse,” in which attackers trick or compromise a signing system into authorizing malicious transactions without extracting the underlying private key. 

“It seems to be… a compromise of signing infrastructure. We don’t think a key was leaked,” he said.

Ben-Natan said this was a preliminary assessment, drawing on their experience with similar attacks and their observations of the onchain activity.

Binance has not confirmed the precise method that allowed hackers to steal over $2.5 billion in crypto from the exchange — the largest crypto hack in history.

Related: Binance hack rattles crypto markets as BNB falls 7%, Bitcoin slides

Blockaid identifies malicious wallet delegation

In its onchain analysis published on X, Blockaid said the attacker bundled 50 EIP-7702 authorizations into a single transaction targeting Binance 14. One authorization reportedly matched the account’s required nonce, allowing it to be accepted.