Binance Hack May Stem From Signing-System Manipulation
The Binance hack may have involved attackers manipulating the exchange’s transaction-signing infrastructure, rather than stealing private keys, Blockaid CEO Ido Ben-Natan told Cointelegraph. He described the finding as preliminary and said the suspected method resembled “key misuse”: tricking or compromising a signing system so it authorizes malicious transactions without exposing the underlying keys.
Blockaid’s on-chain analysis said attackers bundled 50 EIP-7702 authorizations into one transaction targeting Binance 14. An authorization reportedly matched the account’s required nonce, enabling execution and delegation to an unverified contract that could drain tokens and Ether. Binance has not confirmed how the incident occurred. Arkham CEO Miguel Morel said there was not enough information to determine whether keys were stolen or infrastructure was compromised, and suggested the attack might still be ongoing. The article reports losses of more than $2.5 billion.
Ben-Natan compared the suspected Binance hack to the February 2025 Bybit attack, in which attackers compromised a developer’s credentials and deceived wallet signers into approving a malicious transaction. He also said the activity showed similarities to operations attributed to North Korean hackers, though this was not confirmed.
Bearish
The suspected Binance hack is bearish for short-term sentiment because a reported loss exceeding $2.5 billion raises concerns about exchange security, potential further outflows and the possibility that the incident is ongoing. Traders may respond by reducing exposure to exchange-linked assets such as BNB, moving funds to self-custody, or seeking confirmation of the incident’s scale. Volatility and risk premiums could rise across crypto markets, although the article does not establish that the attack affected Bitcoin or the wider network directly.
The incident also highlights a broader operational risk: signing infrastructure can be compromised even if private keys are not extracted. That concern may prompt closer scrutiny of exchange custody and wallet controls. The suspected method has been compared with the February 2025 Bybit attack, where compromised credentials and deceptive transaction approvals were reported. Such parallels can amplify caution, but the Binance attack’s precise cause and any attribution remain unconfirmed. Over the longer term, the market impact will depend on Binance’s response, the recovery or freezing of assets, and evidence about any security changes. A transparent resolution could ease pressure; continued uncertainty or additional losses would likely prolong bearish sentiment.