Binance, the world’s largest cryptocurrency exchange, is facing renewed scrutiny following a suspected multi-billion-dollar hack that has impacted both digital assets and market sentiment. While the precise method of attack remains unconfirmed by Binance, early assessments from security experts indicate that the breach may have exploited vulnerabilities in the platform’s transaction-signing system rather than directly accessing private keys.
Suspected method: Manipulated signatures
Ido Ben-Natan, co-founder and CEO of Blockaid—a blockchain security company—said his team’s preliminary investigation on the Binance exploit points toward “key misuse” rather than a leaked private key. According to Ben-Natan, attackers apparently convinced or compromised the system responsible for authorizing transactions, enabling malicious transfers without possessing the underlying cryptographic keys themselves.
“It seems to be… a compromise of signing infrastructure. We don’t think a key was leaked,” Ben-Natan stated, highlighting the difference between gaining access to a key versus abusing an internal process for signing transactions.
Blockaid’s review drew from both experience with similar incidents and ongoing analysis of onchain activity. Ben-Natan cautioned that these findings are still preliminary, and that further review may be needed as more information comes to light.
Hacker strategy and EIP-7702 exploitation
The attack reportedly involved chaining together a set of authorizations using EIP-7702—a recent technical standard. In its public onchain analysis on X, Blockaid explained that the attacker packed 50 EIP-7702 authorizations into a single transaction targeting the Binance 14 wallet. One of these authorizations met the account’s nonce requirement, making it valid and executable.
EIP-7702, an Ethereum improvement proposal, enables an account to delegate transaction execution to smart-contract code. Through this mechanism, the compromised account was assigned to an unverified sweeper contract that allowed a designated operator to remove tokens and Ether.
Mini dictionary: EIP-7702 is an Ethereum protocol upgrade allowing accounts to temporarily act as smart contracts, making transaction authorization more flexible but potentially increasing risk if not implemented securely.
Miguel Morel, CEO of on-chain analytics firm Arkham, commented that there is insufficient evidence at this stage to determine the exact method of attack. He noted the incident appears to be ongoing, with details still emerging.
Blockaid indicated in their X thread that, “the affected account was delegated to an unverified sweeper contract, allowing a designated operator to drain tokens and Ether.”
Links to previous attacks and North Korean cyber groups
Ben-Natan told analysts there are parallels between the Binance breach and the February 2025 attack on Bybit. In that earlier case, Bybit reported that attackers compromised the credentials of a wallet provider’s developer, accessed infrastructure, and tricked internal signers into authorizing a fraudulent transaction.
The sophistication of on-chain actions seen in the Binance incident has led Blockaid to draw comparisons with operations previously attributed to North Korean cyber actors. The group’s focus on exploiting advanced technical vulnerabilities for financial gain remains a major concern within the crypto security sector.
Ben-Natan further suggested a possibility of multiple compromised devices and internal movement within the exchange network, though this scenario has not been conclusively documented.
Scale and market impact
Binance has not released an official statement detailing the exploit’s technical mechanics. However, the incident resulted in the theft of more than $2.5 billion in cryptocurrencies, making it the largest hack of its kind in the industry’s history.
| Exchange | Year | Amount stolen | Attack method |
|---|---|---|---|
| Binance | 2025 | $2.5 billion | Suspected signing manipulation |
| Bybit | 2025 | Undisclosed | Credential compromise |
News of the exploit triggered sharp volatility across the crypto market. The native Binance token, BNB, declined 7 percent, while Bitcoin registered additional losses as trading sentiment wavered.
Observers warn that the full extent of the breach may only become clear as ongoing investigations progress and more technical findings are made public.
