(Nov 6): The hackers who stole US$6.3 billion from Binance last week found a way to take 40% of the stolen cryptocurrency in one hit, reducing their chances of being caught in the act, and it cost them just US$15.

An examination of transactions recorded on the Ethereum blockchain shows how the thieves weaponised a feature designed to make crypto wallets easier to use. It allows an account to give software permission to move money on its behalf, rather than requiring separate authorizations for each transfer.

The hackers paid about US$15 in network fees to put that permission in place, then used it to take roughly US$2.5 billion in a single transaction — 40% of the total amount stolen — according to security firm Blockaid.

On Tuesday, Binance itself outlined an elaborate timeline in which infiltrators used phony job postings to deceive an engineer into downloading malicious code. It was a “sophisticated, multi-stage campaign,” according to the exchange, replete with social engineering, compromised devices and AI techniques.

Once inside, the hackers targeted a “hot wallet” known as Binance 14, which the exchange uses to process customer withdrawals, records on the Etherscan analytics platform show. This wallet is a bit like an online cash register, and because Binance is the world’s largest crypto exchange, it regularly holds large pools of Ether, stablecoins and dozens of other digital tokens.

Moving so many different assets would ordinarily require a series of separate transfers, each taking time and creating another chance for security systems to spot something unusual.

But an Ethereum software upgrade known as EIP-7702 offered a shortcut. 

Before it was implemented in May 2025, a basic crypto wallet was more akin to a checking account, where the owner generally had to sign off on each transaction. The upgrade added something closer to an autopay function, letting a wallet give software the ability to act on its behalf and bundle several actions together.

At about 8:20 p.m. UTC on Oct 29, the hackers submitted instructions using a valid signature from the Binance 14 wallet telling the Ethereum network to let attacker-controlled code act on the account’s behalf, according to Blockaid. It’s at this point that they paid the routine network processing fee to put that authority in place.

That transaction moved no money, it simply told Ethereum to let the hackers’ software act for the wallet.

“The program does one thing: when its owner asks, it empties the wallet into an address of the owner’s choosing,” blockchain research firm Tibane Labs said in a report.

Three and a half minutes later, the hackers triggered the trap. Operating under the new permissions, the attacker’s software moved roughly US$2.5 billion in a single transaction, according to Blockaid. The haul included 167,464 Ether and more than 60 other tokens, led by US$1.6 billion in Tether’s USDT stablecoin.

“In an attack, the defender wants to slow the attacker down,” said Dan Caspi, co-founder and chief technology officer at Hypernative. “EIP-7702 helped the hackers move faster and maintain control of the wallet even after Binance detected the breach.” 

Because the permission lived on Ethereum, Binance turning off withdrawals or shutting down its hot-wallet services did not automatically cancel it, according to the exchange’s incident report.

With deposits unaffected and continuing to flow into Binance 14, the hackers could still initiate transfers. They ultimately used the same permission to take roughly $3.6 billion, including the initial $2.5 billion haul, with $823 million pulled from another Binance account and four subsequent sweeps of Binance 14, according to a report from blockchain intelligence firm Elliptic.

A Binance spokesperson confirmed that EIP-7702 “played a significant role” in the hack and said the exchange has taken steps to address the risk it exposed. 

“We have revoked the affected delegation, rebuilt the affected wallet infrastructure, and updated our signing and monitoring controls to address this class of authorization risk,” they said. “This includes stricter policies around delegation-type transactions, enhanced behavioral monitoring, additional transaction-level controls, and emergency revocation procedures.”

Binance has also strengthened enforcement of access controls so the access path used cannot be repeated, the spokesperson said, adding “user funds remain protected, and Binance has absorbed the financial impact of this incident.”

The episode shows how tools meant to make crypto accounts simpler can also make a breach far more damaging once an intruder gets inside.

The FBI has attributed the attack, the largest cryptocurrency theft on record, to North Korea. Pyongyang has denied any involvement.

Uploaded by Liza Shireen Koshy