Hackers paid US$15 to drain US$2.5b from Binance in one hit

Sign up now: Get ST's newsletters delivered to your inbox

Hackers suspected to be operating out of North Korea stole US$6.3 billion (S$8 billion) from Binance on Oct 29.

PHOTO: REUTERS

Published Nov 06, 2026, 05:41 PM

Updated Nov 06, 2026, 05:44 PM

• Binance said hackers used a “sophisticated, multi-stage campaign” and Ethereum’s EIP-7702 to gain control of a hot wallet after tricking an engineer with fake job posts.
• The thieves paid about “US$15” in network fees, then drained roughly “US$2.5 billion” in one transaction and later took about “US$3.6 billion” in total, according to Blockaid and Elliptic.
• Binance said it revoked the delegation, rebuilt wallet systems and tightened controls. The FBI blamed North Korea, which denied involvement.

AI generated

SAN FRANCISCO – The hackers who stole US$6.3 billion (S$8 billion) from Binance found a way to take 40% of the stolen cryptocurrency in one hit, reducing their chances of being caught in the act, and it cost them just US$15.

An examination of transactions recorded on the Ethereum blockchain shows how the thieves weaponised a feature designed to make crypto wallets easier to use. It allows an account to give software permission to move money on its behalf, rather than requiring separate authorisations for each transfer.

The hackers paid about US$15 in network fees to put that permission in place, then used it to take roughly US$2.5 billion in a single transaction – 40% of the total amount stolen – according to security firm Blockaid.

On Nov 3, Binance itself outlined an elaborate timeline in which infiltrators used phoney job postings to deceive an engineer into downloading malicious code. It was a “sophisticated, multi-stage campaign”, according to the exchange, replete with social engineering, compromised devices and AI techniques.

Once inside, the hackers targeted a “hot wallet” known as Binance 14, which the exchange uses to process customer withdrawals, records on the Etherscan analytics platform show.

This wallet is a bit like an online cash register, and because Binance is the world’s largest crypto exchange, it regularly holds large pools of Ether, stablecoins and dozens of other digital tokens.

Moving so many different assets would ordinarily require a series of separate transfers, each taking time and creating another chance for security systems to spot something unusual.

But an Ethereum software upgrade known as EIP-7702 offered a shortcut.

Before it was implemented in May 2025, a basic crypto wallet was more akin to a current account, where the owner generally had to sign off on each transaction.

The upgrade added something closer to an autopay function, letting a wallet give software the ability to act on its behalf and bundle several actions together.

At about 8.20pm UTC on Oct 29 (4.20am on Oct 30, Singapore time), the hackers submitted instructions using a valid signature from the Binance 14 wallet telling the Ethereum network to let attacker-controlled code act on the account’s behalf, according to Blockaid. It is at this point that they paid the routine network processing fee to put that authority in place.

That transaction moved no money. It simply told Ethereum to let the hackers’ software act for the wallet.

“The program does one thing: When its owner asks, it empties the wallet into an address of the owner’s choosing,” blockchain research firm Tibane Labs said in a report.

Three-and-a-half minutes later, the hackers triggered the trap.

Operating under the new permissions, the attacker’s software moved roughly US$2.5 billion in a single transaction, according to Blockaid. The haul included 167,464 Ether and more than 60 other tokens, led by US$1.6 billion in Tether’s USDT stablecoin.

Faster getaway

“In an attack, the defender wants to slow the attacker down,” said Dan Caspi, co-founder and chief technology officer at Hypernative. “EIP-7702 helped the hackers move faster and maintain control of the wallet even after Binance detected the breach.”

Because the permission lived on Ethereum, Binance turning off withdrawals or shutting down its hot-wallet services did not automatically cancel it, according to the exchange’s incident report.

With deposits unaffected and continuing to flow into Binance 14, the hackers could still initiate transfers.

They ultimately used the same permission to take roughly US$3.6 billion, including the initial US$2.5 billion haul, with US$823 million pulled from another Binance account and four subsequent sweeps of Binance 14, according to a report from blockchain intelligence firm Elliptic.

A Binance spokesman confirmed that EIP-7702 “played a significant role” in the hack, and said the exchange has taken steps to address the risk it exposed.

“We have revoked the affected delegation, rebuilt the affected wallet infrastructure, and updated our signing and monitoring controls to address this class of authorisation risk,” they said.

“This includes stricter policies around delegation-type transactions, enhanced behavioural monitoring, additional transaction-level controls, and emergency revocation procedures,” it added.

Binance has also strengthened enforcement of access controls so the access path used cannot be repeated, the spokesman said, adding “user funds remain protected, and Binance has absorbed the financial impact of this incident”.

The episode shows how tools meant to make crypto accounts simpler can also make a breach far more damaging once an intruder gets inside.

The US Federal Bureau of Investigation has attributed the attack, the largest cryptocurrency theft on record, to North Korea. Pyongyang has denied any involvement. BLOOMBERG

Cryptocurrencies

Internet crimes and scams

Hacking

Crime

North Korea