A major hack at Binance in which more than $2.5 billion in cryptocurrency flowed out has raised the possibility that transaction-signing infrastructure was compromised, rather than private keys being stolen. An attacker may have abused the transaction approval system to pass malicious transactions as if they had cleared normal authorisation procedures, instead of extracting wallet private keys directly.

Cointelegraph reported on Thursday that Blockaid co-founder and CEO Ido Ben-Natan (이도 벤나탄) said a preliminary analysis weighed more toward “key misuse” than “key leakage”. He said the signing infrastructure appeared to have been compromised, and that he did not conclude the private keys themselves had been leaked.

The analysis comes as Binance has yet to confirm the exact attack path. The key issue is how the attacker bypassed transaction approval controls. Even without stealing private keys directly, manipulating or breaching the signing system could allow malicious transactions to be executed while appearing to have gone through normal approvals.

Blockaid said in an on-chain analysis posted on X that an attacker bundled 50 EIP-7702 approvals targeting Binance14 into a single transaction. It said one of the approvals was accepted because it matched the nonce required for that account.

EIP-7702 is an Ethereum improvement proposal that allows regular accounts to execute delegated smart contract code. Blockaid said the affected account delegated authority to an unverified sweeper contract, designed to let a designated operator drain tokens and ether.

That suggests the attacker may have been able to move assets by exploiting weaknesses in the transaction approval system without obtaining private keys. It remains unconfirmed which system was compromised and how much access the attacker gained inside the exchange.

Ben-Natan also mentioned the possibility that multiple devices were compromised simultaneously, or that additional lateral movement occurred inside the exchange network. He stressed these were early estimates and not confirmed facts. Arkham CEO Miguel Morel (미겔 모렐) also said there was insufficient information to judge whether private key theft or an infrastructure breach was the cause. He added that for now, the hack still appeared to be ongoing.

The market is also focusing on similarities with the Bybit hack in February 2025. Ben-Natan said the two attacks were very similar in method. A forensic report released by Bybit at the time said the attacker compromised the credentials of a Safe developer and then accessed wallet infrastructure. The attacker then deceived signers into approving malicious transactions, it said.

While the perpetrator has not been identified, Blockaid said sophisticated preparatory work seen on-chain showed features similar to operations by North Korea-linked cyber attack groups. It said this was not definitive evidence identifying the attacker.

The incident shows that the core of cryptocurrency exchange security cannot be limited to storing private keys. It said protections must extend beyond wallet access rights to include the systems that validate and sign transactions, the operator terminals that manage them, and internal networks.

If an attacker can abuse signing procedures without directly stealing private keys, existing key management systems alone may not be enough to protect assets. Attention is on whether Binance’s investigation will reveal the actual intrusion path and the extent of damage to internal systems.