The Binance hack may have involved an attack that exploited the signing system used in the transaction approval process, rather than directly stealing private keys.
Ido Ben-Natan, CEO of blockchain security firm Blockaid, said the attacker may have manipulated the system using Binance’s private keys into generating valid signatures for malicious transactions, instead of directly obtaining the exchange’s private keys.
The attacker included 50 EIP-7702 authorization requests in a single transaction. Of these, one was processed successfully because it matched the nonce of the Binance wallet at the time. EIP-7702 allows a standard Ethereum wallet to delegate transaction execution authority to a specific program through a signature. If authorization signatures are exploited, wallet assets can be moved without directly extracting the private key.
Ben-Natan said the method resembled the attack used in the 2025 Bybit hack, in which victims were led to sign a malicious transaction through an interface that appeared to show a legitimate transaction. He added that it also resembled techniques used by North Korea-linked hacking groups. However, the specific intrusion path and whether North Korea was involved have not yet been confirmed.