There are still experts around; they analyzed how Binance was hacked this time on Ethereum, and I think I understand it now.
This time, the hack happened at the signing step, not with the private key.
Ethereum has a feature called 7702 that lets a regular wallet sign a delegation and hand over account management to a smart contract.
It’s like writing a power of attorney that says: From today onward, someone else’s program will manage the account, and whenever money comes in, it will transfer it out.
After the authorization is signed, the account is no longer under your control
This authorization takes effect at a specific nonce
Every wallet has a counter called a nonce, which increases by one with each transaction you send
The authorization is tied to a specific number and only takes effect when the account reaches that number; it is canceled after being used once
The attackers didn’t know what nonce Binance’s wallet had reached at the time, because it was constantly sending transactions
So they had Binance sign 50 consecutive authorizations all at once, one after another, hoping to hit the right nonce
If even one of the 50 authorizations matches the current nonce, it takes effect
And that’s exactly what happened
What’s truly alarming is that Binance itself signed all 50 of these authorizations
The consecutive numbers can be seen on-chain, indicating that they were signed all at once over an extremely short period
Blockaid believes what happened was closer to key misuse than key theft
The private key is still in Binance’s hands, but the attackers made the signing system believe these 50 transactions deserved to be signed
Once the authorization took effect, that wallet was no longer an ordinary wallet
Instead, it became an entry point to the attackers’ contracts, and those contracts had only one function: to withdraw and transfer all the coins and all the ETH, leaving just 1 ETH behind
1 ETH was left so the account could continue sending transactions; if anyone sent it more funds, they were withdrawn in the same way
It wasn’t a one-time theft, but an ongoing drain of funds
Meanwhile, funds were flowing out of Binance’s hot wallets across several chains
This means the attackers didn’t gain access to one particular wallet, but to signing authority that let them affect several wallets at the same time
Over the past ten years, exchange hacks have happened because private keys or seed phrases were leaked, or because of insider involvement
This time, nothing was stolen; the system itself did the signing
After 7702, a single signature could do far more than just one transfer—the attackers hoped to hit the right nonce
If even one of the 50 authorizations matches the current nonce, it takes effect
And that’s exactly what happened
What’s truly alarming is that Binance itself signed all 50 of these authorizations
The consecutive numbers can be seen on-chain, indicating that they were signed all at once over an extremely short period
Blockaid believes what happened was closer to key misuse than key theft
The private key is still in Binance’s hands, but the attackers made the signing system believe these 50 transactions deserved to be signed
Once the authorization took effect, that wallet was no longer an ordinary wallet
But it became an entry point to the attackers’ contracts, and those contracts had only one function: to withdraw and transfer all the coins and all the ETH, leaving just 1 ETH behind
1 ETH was left so the account could continue sending transactions; if anyone sent it more funds, they were withdrawn in the same way
It wasn’t a one-time theft, but an ongoing drain of funds