Key Highlights:
- Cybersecurity analysts are investigating a breach targeting Binance that resulted in the theft of more than $2.5 billion in cryptocurrency, marking the largest hack in crypto history.
- Onchain security firm Blockaid identified the exploitation of an EIP-7702 authorization bundle that allowed a malicious sweeper contract to drain funds from a major Binance wallet.
- Industry experts, including Arkham CEO Miguel Morel and analyst Ben-Natan, note striking similarities to the February 2025 Bybit exploit, pointing toward tactics characteristic of North Korean threat actors.
Investigation Underway in Record-Breaking Binance Cyberattack
In what is being documented as the largest cryptocurrency theft in history, malicious actors have drained more than $2.5 billion in digital assets from Binance. While the exchange has yet to confirm the exact vector utilized to breach its systems, cybersecurity researchers and blockchain forensic investigators are analyzing onchain footprints to determine how the unauthorized transactions were executed.
Arkham CEO Miguel Morel told Cointelegraph there isn’t enough information at this point in time to confirm whether the attack involved stolen keys or compromised infrastructure. Emphasizing the evolving nature of the incident, Morel added, From what we can tell, it appears the hack is still ongoing,
highlighting the active threat landscape facing the centralized trading platform.
Blockaid Identifies Malicious EIP-7702 Delegation
Preliminary forensic findings shared by onchain security firm Blockaid shed light on the technical mechanics behind the breach. In an analysis published on X, Blockaid revealed that the threat actor bundled 50 EIP-7702 authorizations into a single transaction aimed directly at the Binance 14 wallet address. One of the bundled authorizations matched the target account’s required nonce, enabling the transaction to be validated and processed by the network.
The EIP-7702 standard introduces account abstraction capabilities, enabling an account to temporarily delegate execution authority to smart contract code. According to Blockaid, the targeted Binance account was delegated to an unverified sweeper contract. Once execution permissions were established, this malicious contract granted a designated operator the ability to rapidly drain both Ether and various tokens from the exchange’s holdings.
Parallels to the February 2025 Bybit Attack
Analyst Ben-Natan pointed out that this was a preliminary assessment, drawing on experience with similar attacks and observations of onchain activity. Ben-Natan told Cointelegraph the operation could have involved multiple compromised devices and movement through the exchange’s network, though this remains unconfirmed at this stage.
When questioned on whether the suspected signing manipulation echoed the February 2025 Bybit security incident, Ben-Natan described the incidents as very, very similar.
In the Bybit breach, official forensic disclosures confirmed that hackers compromised the credentials of a Safe developer, gained access to the wallet provider’s backend infrastructure, and deceived authorized signers into validating a fraudulent transaction. Given the technical complexity and precision of the onchain preparation in the Binance intrusion, Ben-Natan noted that the activity resembled advanced persistent threat operations typically associated with North Korean cyber attackers.
Why This Matters
The compromise of over $2.5 billion from Binance marks an unprecedented event in decentralized finance and centralized exchange security. The incident demonstrates the potential double-edged sword of advanced Ethereum standards such as EIP-7702, which introduce enhanced programmable flexibility while simultaneously opening complex attack surfaces if authorization controls or nonce handling are compromised. Furthermore, the recurring operational signatures tied to North Korean cyber syndicates underline a sustained, sophisticated campaign targeting institutional digital asset custodians, setting the stage for heightened infrastructure audits and stricter transaction-signing protocols across the crypto sector.
Frequently Asked Questions
What vulnerability did the attackers exploit in the Binance incident?
According to onchain analysis by Blockaid, the attacker utilized EIP-7702 delegation by bundling 50 authorizations into a single transaction against the Binance 14 wallet. Matching the account’s nonce allowed the attacker to bind the wallet to an unverified sweeper contract, which subsequently drained tokens and Ether.
Has Binance officially determined whether private keys or infrastructure were compromised?
No. Binance has not yet confirmed the precise attack vector. Arkham CEO Miguel Morel indicated that current data is insufficient to conclusively determine whether the theft stemmed from exposed private keys or wider infrastructure infiltration.
Why are investigators linking this incident to North Korean threat groups?
Security analyst Ben-Natan noted that the attack bears strong technical resemblance to the February 2025 Bybit breach, where infrastructure access and signing manipulation were used to siphon funds. The level of onchain coordination, sophistication, and infrastructure movement reflects patterns historically associated with North Korean state-sponsored cyber units.
