The suspected Binance hack may have involved attackers manipulating transaction-signing infrastructure rather than stealing private keys, Blockaid co-founder and CEO Ido Ben-Natan said in a preliminary assessment on October 30, 2026. More than $2.5 billion in cryptocurrency was reportedly stolen, but Binance had not confirmed the precise method.

Binance hack signing theory

Ben-Natan said Blockaid’s assessment was based on its experience with similar attacks and observations of on-chain activity. He said the evidence suggested a compromise of signing infrastructure, while adding that the firm did not believe a key had been leaked.

Under that theory, attackers could induce a signing system to authorize malicious transactions without extracting the underlying private key. Ben-Natan said multiple devices and movement through Binance’s network could have been involved, but that remained unconfirmed.

What Blockaid observed on-chain

Blockaid said an attacker bundled 50 EIP-7702 authorizations into one transaction targeting an account identified as Binance 14. One authorization reportedly matched the account’s required nonce, allowing it to be accepted.

The EIP-7702 account delegation specification allows an account to execute code at a delegated address. Blockaid said the affected account was delegated to an unverified contract that let a designated operator drain tokens and Ether.

Ben-Natan described the activity as similar to the February 2025 Bybit attack and to operations linked to North Korean attackers. Those similarities do not establish who was responsible for the Binance incident.

Read More News

More FinanceVelix news

Disclaimer

This FinanceVelix article provides general information, not personalized financial, investment, legal, or tax advice. Market prices, interest rates and economic conditions can change; investments carry a risk of loss. Facts reflect the material available when published and may change. Check important information independently and consult a qualified professional when needed. Mentioning an asset, company, or service is not an endorsement.