Blockaid Co-Founder: Binance Hack May Stem from Private Key Misuse Rather Than a Leak, Resembles Operations by North Korean Hackers

on October 30, according to Cointelegraph, Blockaid Co-founder and CEO Ido Ben-Natan stated that a preliminary assessment suggests the suspected breach at Binance may involve the abuse of private keys rather than theft, meaning attackers compromised the signature system to authorize malicious transactions without needing to extract private keys. He remarked: "It appears the signature infrastructure was breached, and we believe the private keys were not leaked."

Ben-Natan noted this is a preliminary assessment; the attack may involve multiple compromised devices and lateral movement across internal networks, though this remains unconfirmed. He drew comparisons to the February 2025 Bybit hack, noting that the on-chain preparation methods resemble the operational patterns associated with North Korean hackers.

Binance has yet to confirm the specific attack methodology; these statements are personal opinions.