Ever wonder why a crypto exchange can lose billions without a private key ever being stolen? This article explains how attackers can abuse an exchange’s transaction‑signing systems, what “key misuse” really means, and how you can evaluate the safety of platforms that hold your assets.
What a signing‑infrastructure attack is
A crypto exchange must sign every withdrawal or transfer it makes on behalf of its users. Signing means creating a cryptographic signature that proves the transaction came from an authorized account. The signature is generated with a private key—a secret number that only the holder should know. In a traditional theft, a hacker steals that private key and can then sign any transaction they like.
In a signing‑infrastructure attack, the private key itself stays hidden. Instead, attackers compromise the software or hardware that produces signatures. By tricking the signing system into approving a malicious transaction, they can move funds without ever extracting the key. This is sometimes called key misuse because the key is used correctly from a cryptographic standpoint, but the request to use it is forged.
Key components involved include:
- Signing service: The backend that receives a transaction request and applies the private key to generate a signature.
- API or internal communication: The channel through which the request reaches the signing service.
- Access controls: Permissions that determine which internal processes or users can ask the signer to act.
If any of these layers are weak—e.g., insecure APIs, compromised developer credentials, or poorly isolated signing hardware—attackers can inject a transaction that looks legitimate to the signer. The signer then produces a valid signature, and the blockchain accepts the transaction as authentic.
Real‑world illustration: the Binance incident
In October 2026, Blockaid’s co‑founder Ido Ben‑Natan reported that the massive Binance hack, which resulted in the loss of over $2.5 billion, likely involved such a signing‑infrastructure compromise. According to Blockaid’s on‑chain analysis, attackers bundled fifty EIP‑7702 authorizations into a single transaction targeting Binance. One of those authorizations matched the required nonce, allowing the malicious transaction to be accepted. The compromised account had delegated execution to an unverified “sweeper” contract that let the attacker drain tokens and Ether.
Ben‑Natan emphasized that the private key itself was probably not leaked; instead, the signing system was tricked into authorizing the transfer. The method bears similarity to the February 2025 Bybit breach, where attackers accessed a wallet provider’s infrastructure and deceived signers into approving fraudulent withdrawals.
What this means for you
If you store crypto on an exchange, your assets are only as safe as the exchange’s signing infrastructure. Even a robust key‑management policy cannot protect you if the software that uses the key is compromised. This risk is especially relevant for large platforms that handle billions of dollars, because a successful attack can affect many users at once.
For individuals looking to earn passive income through exchange‑based services—such as staking, lending, or cloud mining rewards—understanding this risk is essential. While these services can be convenient, they add an extra layer where a signing‑infrastructure breach could jeopardize your earnings.
How to assess the security of an exchange’s signing process
- Transparency reports: Look for public security audits or post‑mortem analyses that detail how the platform protects its signing keys.
- Multi‑party computation (MPC) or hardware security modules (HSM): These technologies split the private key or keep it in tamper‑proof hardware, reducing the chance of misuse.
- Access control policies: Verify that the exchange enforces strict role‑based access and limits which internal services can request signatures.
- API security: Secure, authenticated APIs for transaction requests help prevent unauthorized signing calls.
- Bug bounty programs: Active programs indicate that the platform invites external security researchers to find flaws before attackers do.
FAQ
What’s the difference between a stolen private key and key misuse?
A stolen private key gives an attacker full control to sign any transaction at any time. Key misuse occurs when the attacker convinces the legitimate signing system to sign a specific malicious transaction without ever obtaining the key itself.
Can I protect my funds by using a hardware wallet instead of an exchange?
Yes. With a hardware wallet, the private key never leaves the device, and signing happens offline. This eliminates the risk of signing‑infrastructure attacks that target centralized services.
Do all exchanges use the same signing architecture?
No. Some rely on simple software wallets, while others employ advanced solutions like multi‑party computation or hardware security modules. The security level varies widely, so it’s important to investigate each platform’s approach.
If an exchange is hacked, am I guaranteed to lose my assets?
Not necessarily. Some exchanges maintain insurance funds or have compensation policies, but these are not universal and often come with strict conditions. Always read the terms and consider diversifying where you keep your crypto.
This article references reporting from cointelegraph.com.
