Independent record. Not associated with, endorsed by or operated by Binance. This site is read-only: there is nothing to sign in to, pay for or connect.
An independent record of the October 2026 Binance hack
People. CEO of Blockaid
The statements below are attributed to this speaker by the cited sources. Appearing here is not an accusation.
Ben-Natan also said the activity resembled operations linked to North Korea, citing Blockaid’s familiarity with those attacks. He pointed to sophisticated onchain preparations but emphasized that the attribution remained unconfirmed.
a compromise of signing infrastructure. We don’t think a key was leaked,” he said.
Attackers could have stolen the funds without EIP-7702, Ido Ben-Natan, Blockaid’s co-founder and CEO, told Cointelegraph on Friday.
“The 7702 upgrade is a way to do this in one sweep and maybe a way to bypass some sort of checks they may have,”
“The takeaway is that ultimately the signer signed a transaction that they shouldn’t have,” he said.
Ben-Natan said attackers may have used a compromised developer’s computer to gain access to Binance’s wallet-signing infrastructure.
Ben-Natan warned that similar signing-system attacks threaten other exchanges and said transaction simulation could help detect malicious requests before they receive approval.
Blockaid CEO Ido Ben-Natan said the attackers appeared to have compromised Binance’s transaction signing process. Binance said Friday that it had found no evidence of leaked wallet private keys, though its investigation remained ongoing.