Binance hack may involve private key ‘misuse,’ not theft: Blockaid CEO - Cryptonews.net

Blockaid's preliminary assessment suggests the attackers compromised the exchange's signing infrastructure, tricking it into authorizing malicious transactions without extracting the underlying private key. This method, described as 'key misuse,' differs from traditional key theft.

Binance has not confirmed the precise method used in the largest crypto hack in history, which resulted in the theft of over $2.5 billion in cryptocurrency. Arkham CEO Miguel Morel noted there isn't enough information to confirm whether stolen keys or compromised infrastructure were involved.

Attack method

Blockaid's analysis revealed the attacker bundled 50 EIP-7702 authorizations into a single transaction targeting Binance 14. One authorization matched the account's required nonce, allowing it to be accepted. The affected account was delegated to an unverified sweeper contract that enabled a designated operator to drain tokens and Ether.

Ben-Natan suggested the operation could have involved multiple compromised devices and movement through the exchange's network, though this remains unconfirmed. He described the incident as 'very, very similar' to the February 2025 Bybit attack, where attackers compromised a Safe developer's credentials.

North Korean link

The sophistication of the on-chain preparations resembles operations linked to North Korean cyber attackers, according to Ben-Natan. Like the Bybit case, the Binance hack involved deceiving signers into approving malicious transactions after accessing the wallet provider's infrastructure.

Morel noted from Arkham's perspective, 'it appears the hack is still ongoing,' suggesting the full extent of the breach may not yet be understood. The investigation continues as security analysts work to determine the exact methods used by the attackers.