Binance Hack May Stem From Private Key Misuse, Security Firm Says
Blockaid's CEO suspects attackers manipulated Binance's signing infrastructure, echoing tactics seen in the Bybit breach.
A suspected security breach at Binance may not involve outright private key theft but rather the deliberate misuse of the exchange's transaction-signing infrastructure, according to Ido Ben-Natan, CEO of blockchain security firm Blockaid. The distinction is significant: rather than stealing keys outright, attackers may have manipulated the systems that authorize transactions, allowing them to move funds while appearing to operate legitimately within the platform's own architecture.
Ben-Natan drew direct comparisons to the high-profile Bybit hack, suggesting the two incidents share a methodological fingerprint. In the Bybit case, attackers compromised signing infrastructure rather than extracting private keys directly — a more sophisticated approach that can be harder to detect in real time and may bypass conventional security alerts that look for unauthorized access patterns.
Read more Amazon Reports $42.4B Negative Free Cash Flow in Q3 →
The framing points to an evolving threat model targeting centralized exchanges. If attackers are increasingly focusing on the signing layer — the mechanism that cryptographically approves outgoing transactions — it suggests that securing private key storage alone is no longer sufficient. Exchanges may need to harden the entire transaction-approval pipeline, including the software and hardware environments in which signing occurs.
Blockaid specializes in detecting malicious on-chain activity, giving Ben-Natan's assessment analytical weight, though Binance has not publicly confirmed the specific attack vector. The nature of such infrastructure-level compromises means forensic attribution can take days or weeks, leaving the broader crypto community watching for official disclosures.
Continue reading at Cointelegraph.
