Blockaid Points to Signing System Compromise in $2.5B Binance Breach

Attackers who stole over $2.5 billion from cryptocurrency exchange Binance may have compromised its transaction-signing infrastructure rather than exfiltrating underlying private keys, according to security firm Blockaid ¹. The incident represents the largest cryptocurrency theft recorded to date ¹. At the time of writing, $BTC traded at $77,467, down 4.6% over the prior 24 hours, while $ETH fell 5.1% to $2,235 amid broader market turbulence.

In a preliminary assessment, Blockaid co-founder and CEO Ido Ben-Natan stated that the breach pointed toward "key misuse" ¹. Under this vector, attackers manipulate an account or its signing environment into executing unauthorized transfers without directly stealing the private key itself ¹. Ben-Natan noted that the operation could have involved multiple compromised internal devices and lateral movement through Binance's network, although those details remain unconfirmed ¹. Binance has not officially confirmed the specific mechanism used to carry out the exploit ¹.

Technical Vectors and Bybit Parallels

On-chain analysis published by Blockaid indicated that the attacker batched 50 EIP-7702 authorizations into a single transaction aimed at a Binance account labeled Binance 14 ¹. EIP-7702 enables an externally owned account to delegate execution authority to smart contract code ¹. One of the bundled authorizations matched the target account's required nonce, enabling acceptance and delegating the wallet to an unverified sweeper contract that allowed an operator to drain tokens and $ETH ¹.

Ben-Natan described the incident as "very, very similar" to the February 2025 attack on Bybit, in which attackers breached developer credentials at wallet provider Safe to deceive signing systems into approving malicious transactions ¹. The sophistication of the on-chain preparations led Blockaid to observe similarities to campaigns typically associated with North Korean cyber operations ¹. The investigation follows previous industry research where Blockaid finds hackers hold $287 million in stolen crypto beyond freezing reach, demonstrating persistent hurdles in asset recovery after multi-signature and custodial breaches.