The hackers who attacked Binance needed just $15 to gain the ability to transfer $2.5 billion in a single transaction. The attack, in which cryptocurrencies worth a total of $6.3 billion were stolen, reveals how a technological innovation created to simplify the use of digital wallets can become an extremely effective tool in the hands of cybercriminals. An analysis of transactions recorded on the Ethereum blockchain shows that the attackers exploited a feature allowing a digital wallet to authorise software to carry out transactions on its behalf, without requiring separate approval for each transfer.

According to cybersecurity firm Blockaid, the hackers paid approximately $15 in network fees to activate this authorisation and then stole approximately $2.5 billion in a single transaction, an amount equivalent to 40% of the total haul. In this way, they drastically reduced the time needed to transfer the cryptocurrencies, while also minimising the chances of being detected in time by security systems.

The trap involving fake job advertisements

The attack did not begin with the blockchain, but with a much more familiar target: a Binance employee.

On Tuesday, the world’s largest cryptocurrency exchange laid out the timeline of the breach, describing a complex operation involving deceptive job advertisements, malware and artificial intelligence techniques. The attackers used fake job opportunities to deceive a company engineer and persuade him to download malicious code.

Binance described the attack as a “sophisticated, multi-stage campaign”, involving social engineering techniques, compromised devices and the use of AI. After gaining access to the systems, the attackers focused on a digital wallet known as Binance 14, which is used to process customer withdrawals. This is what is known as a hot wallet, meaning a wallet connected to the internet, which essentially functions as an online cash register.

As Binance is the world’s largest cryptocurrency exchange, this particular wallet regularly handles large quantities of Ether, stablecoins and dozens of other digital assets.

The Ethereum loophole that made the theft possible

Under normal circumstances, transferring such a large number of different cryptocurrencies would require a series of separate transactions. Each transaction would take time to execute, creating additional opportunities for security systems to detect suspicious activity.

However, an Ethereum technological upgrade, known as EIP-7702, offered the attackers a much faster route. Before it was introduced in May 2025, a standard cryptocurrency wallet operated much like a bank account, with its owner having to approve each transfer individually.

The new feature added something akin to a standing payment order: the ability for a wallet to grant software the authority to act on its behalf and combine multiple operations into a single transaction. The feature was designed to make digital wallets easier to use. In Binance’s case, however, it proved decisive to the success of the attack.

How $2.5bn disappeared in three and a half minutes

On 29 October, at approximately 22:20 Greek time, the hackers submitted an instruction to the Ethereum network bearing a valid digital signature from Binance 14’s wallet. The instruction allowed code controlled by the attackers to act on behalf of that particular wallet. It was at this precise stage that the approximately $15 in network fees was paid.

The first transaction did not transfer any money. It simply granted the attackers’ software the necessary permissions. As blockchain research firm Tibane Labs explained, the programme had just one function: whenever its operator requested it, it emptied the wallet, transferring the assets to an address of the operator’s choice.

Three and a half minutes later, the trap was sprung. With the new authorisation in place, the malicious software transferred approximately $2.5 billion in a single transaction. According to Blockaid, the amount included 167,464 Ether and more than 60 different digital tokens. The largest share of the haul came from Tether’s USDT stablecoin, worth approximately $1.6 billion.

Why Binance could not immediately stop the transfers

The most alarming feature of the attack was that the attackers’ authorisation remained active on the Ethereum network itself. This meant that even if Binance disabled withdrawals or suspended the operation of its online wallets, doing so would not automatically revoke the authorisation the hackers had obtained. “In an attack, the defender wants to slow down the attacker,” explained Dan Caspi, co-founder and chief technology officer of Hypernative.

As he noted, the EIP-7702 feature helped the hackers move faster and retain control of the wallet even after Binance detected the breach. The situation was further complicated by the fact that deposits into Binance 14 had not been halted. As a result, new funds continued to flow into the wallet, giving the attackers further opportunities to transfer money.

According to blockchain analytics firm Elliptic, the hackers ultimately used the same authorisation to steal approximately $3.6 billion. This amount included the initial $2.5 billion transfer, a further $823 million from another Binance account, and four subsequent transactions removing funds from Binance 14.

Binance’s response

A Binance spokesperson confirmed that the EIP-7702 upgrade played a significant role in the attack. The exchange also said it had already taken steps to address the specific risk.

“We revoked the affected authorisation, rebuilt the wallet infrastructure and updated signature and monitoring controls,” the spokesperson said. As explained, the new measures include stricter policies for authorisation-granting transactions, enhanced monitoring for suspicious behaviour, additional transaction-level checks and emergency revocation procedures.

Binance has also strengthened its access-control mechanisms to prevent a repeat of the method used to gain initial access. The spokesperson assured users that customer funds remain protected and that Binance has absorbed the financial impact of the breach.

FBI points to North Korea

The attack is considered the largest cryptocurrency theft ever recorded, surpassing previous major breaches in the digital asset market. The FBI attributes the operation to North Korea, which has also been accused in the past of carrying out extensive cyberattacks aimed at obtaining cryptocurrencies. Pyongyang denies any involvement. The case highlights a new risk for the digital asset market: the ability of malicious actors to exploit legitimate blockchain features designed to simplify transactions.

The problem was not simply that the hackers managed to break into Binance’s systems. It was that, once they had gained access, a feature intended to serve users allowed them to transfer billions of dollars in a matter of minutes. And this is a particularly significant warning for the industry, as the greater ease of using digital wallets may come with new and far more complex security challenges.