Blockaid’s Ido Ben-Natan suspects attackers manipulated Binance’s transaction-signing infrastructure, drawing parallels with the Bybit hack.

The suspected multi-billion-dollar Binance hack may have involved attackers manipulating the exchange’s transaction-signing signature rather than stealing private keys, according to Blockaid co-founder and CEO Ido Ben-Natan.

Speaking to Cointelegraph, Ben-Natan said Blockaid’s preliminary assessment pointed to “key misuse,” in which attackers trick or compromise a signing system into authorizing malicious transactions without extracting the underlying private key.

“It seems to be… a compromise of signing infrastructure. We don’t think a key was leaked,” he said.

Ben-Natan said this was a preliminary assessment, drawing on their experience with similar attacks and their observations of the onchain activity.

Binance has not confirmed the precise method that allowed hackers to steal over $2.5 billion in crypto from the exchange — the largest crypto hack in history.

Arkham CEO Miguel Morel told Cointelegraph there isn’t enough information at this point in time to confirm whether the attack involved stolen keys or compromised infrastructure.

“From what we can tell, it appears the hack is still ongoing,” he said.

Related: Binance hack rattles crypto markets as BNB falls 7%, Bitcoin slides

In its onchain analysis published on X, Blockaid said the attacker bundled 50 EIP-7702 authorizations into a single transaction targeting Binance 14. One authorization reportedly matched the account’s required nonce, allowing it to be accepted.

EIP-7702 allows an account to delegate execution to smart-contract code. Blockaid said the affected account was delegated to an unverified sweeper contract that allowed a designated operator to drain tokens and Ether.

Source link