How hackers stole $6.3bn from Binance with a $15 transaction – the security loophole they exploited - ProtoThema English

The hackers who attacked Binance needed just $15 to gain the ability to transfer $2.5 billion in a single transaction. The attack, in which cryptocurrencies worth a total of $6.3 billion were stolen, reveals how a technological innovation created to simplify the use of digital wallets can become an extremely effective tool in the hands of cybercriminals. An analysis of transactions recorded on the Ethereum blockchain shows that the attackers exploited a feature allowing a digital wallet to authorise software to carry out transactions on its behalf, without requiring separate approval for each transfer.

According to cybersecurity firm Blockaid, the hackers paid approximately $15 in network fees to activate this authorisation and then stole approximately $2.5 billion in a single transaction, an amount equivalent to 40% of the total haul. In this way, they drastically reduced the time needed to transfer the cryptocurrencies, while also minimising the chances of being detected in time by security systems.

Fake job advertisements

The attack did not begin with the blockchain, but with a much more familiar target: a Binance employee. On Tuesday, the world's largest cryptocurrency exchange laid out the timeline of the breach, describing a complex operation involving deceptive job advertisements, malware and artificial intelligence techniques. The attackers used fake job opportunities to deceive a company engineer and persuade him to download malicious code.

Binance described the attack as a 'sophisticated, multi-stage campaign', involving social engineering techniques, compromised devices and the use of AI. After gaining access to the systems, the attackers focused on a digital wallet known as Binance 14, which is used to process customer withdrawals. This is what is known as a hot wallet, meaning a wallet connected to the internet, which essentially functions as an online cash register.

As Binance is the world's largest cryptocurrency exchange, this particular wallet regularly handles large quantities of Ether, stablecoins and dozens of other digital assets.

Ethereum security loophole

Under normal circumstances, transferring such a large number of different cryptocurrencies would require a series of separate transactions. Each transaction would take time to execute, creating additional opportunities for security systems to detect suspicious activity.

However, an Ethereum technological upgrade, known as EIP-7702, offered the attackers a much faster route. Before it was introduced in May 2025, a standard cryptocurrency wallet operated much like a bank account, with its owner having to approve each transfer individually. The new feature added something akin to a standing payment order: the ability for a wallet to grant software the authority to act on its behalf and combine multiple operations into a single transaction.

The feature was designed to make digital wallets easier to use. In Binance's case, however, it proved decisive to the success of the attack.

Billions transferred in minutes

On 29 October, at approximately 22:20 Greek time, the hackers submitted an instruction to the Ethereum network bearing a valid digital signature from Binance 14's wallet. The instruction allowed code controlled by the attackers to act on behalf of that particular wallet. It was at this precise stage that the approximately $15 in network fees was paid.

Three and a half minutes later, the trap was sprung. With the new authorisation in place, the malicious software transferred approximately $2.5 billion in a single transaction. According to Blockaid, the amount included 167,464 Ether and more than 60 different digital tokens. The largest share of the haul came from Tether's USDT stablecoin, worth approximately $1.6 billion.

Binance response

The most alarming feature of the attack was that the attackers' authorisation remained active on the Ethereum network itself. This meant that even if Binance disabled withdrawals or suspended the operation of its online wallets, doing so would not automatically revoke the authorisation the hackers had obtained.

According to blockchain analytics firm Elliptic, the hackers ultimately used the same authorisation to steal approximately $3.6 billion. This amount included the initial $2.5 billion transfer, a further $823 million from another Binance account, and four subsequent transactions removing funds from Binance 14.

A Binance spokesperson confirmed that the EIP-7702 upgrade played a significant role in the attack. The exchange also said it had already taken steps to address the specific risk. 'We revoked the affected authorisation, rebuilt the wallet infrastructure and updated signature and monitoring controls,' the spokesperson said. As explained, the new measures include stricter policies for authorisation-granting transactions, enhanced monitoring for suspicious behaviour, additional transaction-level checks and emergency revocation procedures.

Binance has also strengthened its access-control mechanisms to prevent a repeat of the method used to gain initial access. The spokesperson assured users that customer funds remain protected and that Binance has absorbed the financial impact of the breach.

The attack is considered the largest cryptocurrency theft ever recorded, surpassing previous major breaches in the digital asset market. The FBI attributes the operation to North Korea, which has also been accused in the past of carrying out extensive cyberattacks aimed at obtaining cryptocurrencies. Pyongyang denies any involvement. The case highlights a new risk for the digital asset market: the ability of malicious actors to exploit legitimate blockchain features designed to simplify transactions.