<\/p>\n
The hackers who stole $6.3 billion from Binance last week found a way to take 40% of the stolen cryptocurrency in one hit, reducing their chances of being caught in the act, and it cost them just $15.<\/p>\n
An examination of transactions recorded on the Ethereum blockchain shows how the thieves weaponised a feature designed to make crypto wallets easier to use. It allows an account to give software permission to move money on its behalf, rather than requiring separate authorisations for each transfer.<\/p>\n
The hackers paid about $15 in network fees to put that permission in place, then used it to take roughly $2.5 billion in a single transaction \u2014 40% of the total amount stolen \u2014 according to security firm Blockaid.<\/p>\n
On Tuesday, Binance itself outlined an elaborate timeline in which infiltrators used phony job postings to deceive an engineer into downloading malicious code. It was a \u201csophisticated, multi-stage campaign,\u201d according to the exchange, replete with social engineering, compromised devices and AI techniques.<\/p>\n<\/p>\n
Once inside, the hackers targeted a \u201chot wallet\u201d known as Binance 14, which the exchange uses to process customer withdrawals, records on the Etherscan analytics platform show. This wallet is a bit like an online cash register, and because Binance is the world\u2019s largest crypto exchange, it regularly holds large pools of Ether, stablecoins and dozens of other digital tokens.<\/p>\n
Shortcut<\/p>\n
Moving so many different assets would ordinarily require a series of separate transfers, each taking time and creating another chance for security systems to spot something unusual.<\/p>\n
But an Ethereum software upgrade known as EIP-7702 offered a shortcut.<\/p>\n
ADVERTISEMENT<\/p>\n
CONTINUE READING BELOW<\/p>\n
Before it was implemented in May 2025, a basic crypto wallet was more akin to a checking account, where the owner generally had to sign off on each transaction. The upgrade added something closer to an auto-pay function, letting a wallet give software the ability to act on its behalf and bundle several actions together.<\/p>\n
At about 8:20 p.m. UTC on October 29, the hackers submitted instructions using a valid signature from the Binance 14 wallet telling the Ethereum network to let attacker-controlled code act on the account\u2019s behalf, according to Blockaid. It\u2019s at this point that they paid the routine network processing fee to put that authority in place.<\/p>\n
That transaction moved no money, it simply told Ethereum to let the hackers\u2019 software act for the wallet.<\/p>\n
\u201cThe program does one thing: when its owner asks, it empties the wallet into an address of the owner\u2019s choosing,\u201d blockchain research firm Tibane Labs said in a report.<\/p>\n
Three and a half minutes later, the hackers triggered the trap. Operating under the new permissions, the attacker\u2019s software moved roughly $2.5 billion in a single transaction, according to Blockaid. The haul included 167 464 Ether and more than 60 other tokens, led by $1.6 billion in Tether\u2019s USDT stablecoin.<\/p>\n
Faster getaway<\/p>\n
\u201cIn an attack, the defender wants to slow the attacker down,\u201d said Dan Caspi, co-founder and chief technology officer at Hypernative. \u201cEIP-7702 helped the hackers move faster and maintain control of the wallet even after Binance detected the breach.\u201d<\/p>\n
Because the permission lived on Ethereum, Binance turning off withdrawals or shutting down its hot-wallet services did not automatically cancel it, according to the exchange\u2019s incident report.<\/p>\n
ADVERTISEMENT:<\/p>\n
CONTINUE READING BELOW<\/p>\n
With deposits unaffected and continuing to flow into Binance 14, the hackers could still initiate transfers. They ultimately used the same permission to take roughly $3.6 billion, including the initial $2.5 billion haul, with $823 million pulled from another Binance account and four subsequent sweeps of Binance 14, according to a report from blockchain intelligence firm Elliptic.<\/p>\n
A Binance spokesperson confirmed that EIP-7702 \u201cplayed a significant role\u201d in the hack and said the exchange has taken steps to address the risk it exposed.<\/p>\n
\u201cWe have revoked the affected delegation, rebuilt the affected wallet infrastructure, and updated our signing and monitoring controls to address this class of authorisation risk,\u201d they said. \u201cThis includes stricter policies around delegation-type transactions, enhanced behavioural monitoring, additional transaction-level controls, and emergency revocation procedures.\u201d<\/p>\n
Binance has also strengthened enforcement of access controls so the access path used cannot be repeated, the spokesperson said, adding \u201cuser funds remain protected, and Binance has absorbed the financial impact of this incident.\u201d<\/p>\n
The episode shows how tools meant to make crypto accounts simpler can also make a breach far more damaging once an intruder gets inside.<\/p>\n
The FBI has attributed the attack, the largest cryptocurrency theft on record, to North Korea. Pyongyang has denied any involvement.<\/p>\n
\u00a9 2026 Bloomberg<\/p>\n
#Hackers #paid #drain #2.5bn #Binance #hit<\/p>\n","protected":false},"excerpt":{"rendered":"
The hackers who stole $6.3 billion from Binance last week found a way to take…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[4],"tags":[24207,8509,4283,8041,1251,5287],"_links":{"self":[{"href":"https:\/\/stock999.top\/index.php?rest_route=\/wp\/v2\/posts\/19877"}],"collection":[{"href":"https:\/\/stock999.top\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/stock999.top\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/stock999.top\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/stock999.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=19877"}],"version-history":[{"count":0,"href":"https:\/\/stock999.top\/index.php?rest_route=\/wp\/v2\/posts\/19877\/revisions"}],"wp:attachment":[{"href":"https:\/\/stock999.top\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=19877"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/stock999.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=19877"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/stock999.top\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=19877"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}