Binance Hack May Have Exploited Transaction Approval System, Echoing Bybit Breach

Blockaid Raises Possibility of Abuse of Signing Framework

"Very, Very Similar" to Last Year's Bybit Attack

The attacker behind the Binance hack may have exploited the exchange's transaction approval system instead of stealing a private key. The analysis suggests the attacker deceived the system that uses the secret credentials needed to move assets into signing malicious transactions, without directly extracting those credentials.

Cointelegraph reported on Oct. 29 that Blockaid co-founder and Chief Executive Officer Ido Ben-Natan said the "signing infrastructure appears to have been compromised" and that he does not believe a private key was leaked.

A private key is the password used to sign crypto transactions and prove control of assets. If it is stolen, an attacker can approve transactions directly. Ben-Natan's theory instead points to abuse of the signing system, in which the private key never leaves its environment but the infrastructure is taken over or tricked into authorizing unwanted transactions.

Blockaid believes the attacker abused Binance's transaction approval system to drain digital assets from the wallet. In its view, the system granted the attacker's program permission to control the wallet, and the program then sent the assets out.

According to Blockaid, the wallet had delegated execution authority to an unverified asset recovery contract. That contract included a function allowing a designated operator to withdraw the wallet's tokens and Ether. A legitimate delegation feature was exploited as a route for asset theft.

Ben-Natan also pointed to similarities with the Bybit hack in February last year. "The two incidents are very, very similar," he said. Findings released by Bybit at the time showed that the attacker stole developer credentials from external wallet service Safe, gained access to the infrastructure, and then tricked signers into approving malicious transactions.

Ben-Natan added that the attack resembled operations tied to North Korean-linked hackers, citing the sophistication of the on-chain preparation beforehand.