Hackers paid US$15 to drain US$2.5b from Binance in one hit - The Straits Times
Hackers who stole $6.3 billion from Binance used a cryptocurrency feature to take 40% of the stolen funds in one transaction, costing them just $15 in network fees.
The examination of transactions on the Ethereum blockchain reveals how the thieves weaponized a feature designed to make crypto wallets more user-friendly. This feature allows an account to give software permission to move money on its behalf, rather than requiring separate authorizations for each transfer. The hackers paid approximately $15 in network fees to establish this permission, then used it to transfer roughly $2.5 billion in a single transaction – 40% of the total amount stolen, according to security firm Blockaid.
Attack Timeline
On November 3, Binance outlined an elaborate timeline of the attack, describing it as a "sophisticated, multi-stage campaign" involving social engineering, compromised devices, and AI techniques. The hackers used fake job postings to deceive an engineer into downloading malicious code, gaining access to Binance's systems.
Once inside, the attackers targeted a "hot wallet" known as Binance 14, which the exchange uses to process customer withdrawals. This wallet, similar to an online cash register, regularly holds large pools of Ether, stablecoins, and other digital tokens due to Binance being the world's largest crypto exchange.
Exploiting Ethereum Upgrade
The hackers took advantage of an Ethereum software upgrade called EIP-7702, implemented in May 2025. This upgrade added an "autopay function" to crypto wallets, allowing them to give software the ability to act on their behalf and bundle multiple actions together. Before this upgrade, each transaction typically required separate authorization.
At about 8.20pm UTC on October 29, the hackers submitted instructions using a valid signature from the Binance 14 wallet, telling the Ethereum network to let attacker-controlled code act on the account's behalf. Three-and-a-half minutes later, they triggered the trap, moving approximately $2.5 billion in a single transaction.
The program does one thing: When its owner asks, it empties the wallet into an address of the owner's choosing.
Aftermath and Response
The EIP-7702 feature helped the hackers move faster and maintain control of the wallet even after Binance detected the breach. Because the permission existed on Ethereum, Binance turning off withdrawals didn't automatically cancel it. The hackers ultimately used the same permission to take roughly $3.6 billion in total.
A Binance spokesman confirmed that EIP-7702 "played a significant role" in the hack, noting that the exchange has taken steps to address the exposed risk. "We have revoked the affected delegation, rebuilt the affected wallet infrastructure, and updated our signing and monitoring controls," they said, adding that user funds remain protected and Binance has absorbed the financial impact.
The episode demonstrates how tools meant to simplify crypto accounts can make breaches more damaging once intruders gain access. The FBI has attributed the attack, the largest cryptocurrency theft on record, to North Korea, which has denied any involvement.
Related
