Binance hackers weaponised feature that makes crypto wallets easier to use

[MUMBAI] The hackers who stole US$6.3 billion from Binance last week found a way to take 40 per cent of the stolen cryptocurrency in one hit, reducing their chances of being caught in the act, and it cost them just US$15.

An examination of transactions recorded on the Ethereum blockchain shows how the thieves weaponised a feature designed to make crypto wallets easier to use.

It allows an account to give software permission to move money on its behalf, rather than requiring separate authorisations for each transfer.

The hackers paid about US$15 in network fees to put that permission in place, then used it to take roughly US$2.5 billion in a single transaction – 40 per cent of the total amount stolen – according to security firm Blockaid.

On Tuesday (Nov 3), Binance itself outlined an elaborate timeline in which infiltrators used phony job postings to deceive an engineer into downloading malicious code.

It was a “sophisticated, multi-stage campaign”, according to the exchange, replete with social engineering, compromised devices and artificial intelligence techniques.

THE BUSINESS TIMES INSIGHTS

Powering Asean's Future 2026

Find out how enterprises are navigating power constraints and sustainability targets

ACCESS THE INSIGHTS

Once inside, the hackers targeted a “hot wallet” known as Binance 14, which the exchange uses to process customer withdrawals, records on the Etherscan analytics platform show.

This wallet is a bit like an online cash register, and because Binance is the world’s largest crypto exchange, it regularly holds large pools of Ether, stablecoins and dozens of other digital tokens.

Shortcut

Moving so many different assets would ordinarily require a series of separate transfers, each taking time and creating another chance for security systems to spot something unusual.

SEE ALSO

Binance loses market share to crypto exchange rivals after hack

Binance says hackers plotted US$6.3 billion heist for months

North Korea says US allegations linking it to Binance heist are ‘absurd rhetoric’, KCNA says

But an Ethereum software upgrade known as EIP-7702 offered a shortcut. 

Before it was implemented in May 2025, a basic crypto wallet was more akin to a checking account, where the owner generally had to sign off on each transaction.

The upgrade added something closer to an autopay function, letting a wallet give software the ability to act on its behalf and bundle several actions together.

At about 8.20 pm UTC on Oct 29, the hackers submitted instructions using a valid signature from the Binance 14 wallet telling the Ethereum network to let attacker-controlled code act on the account’s behalf, according to Blockaid.

It was at this point that they paid the routine network processing fee to put that authority in place.

That transaction moved no money, it simply told Ethereum to let the hackers’ software act for the wallet.

“The programme does one thing: when its owner asks, it empties the wallet into an address of the owner’s choosing,” blockchain research firm Tibane Labs said in a report.

Three and a half minutes later, the hackers triggered the trap. Operating under the new permissions, the attacker’s software moved roughly US$2.5 billion in a single transaction, according to Blockaid.

The haul included 167,464 Ether and more than 60 other tokens, led by US$1.6 billion in Tether’s USDT stablecoin.

Faster getaway

“In an attack, the defender wants to slow the attacker down,” said Dan Caspi, co-founder and chief technology officer at Hypernative. “EIP-7702 helped the hackers move faster and maintain control of the wallet even after Binance detected the breach.” 

Because the permission lived on Ethereum, Binance turning off withdrawals or shutting down its hot-wallet services did not automatically cancel it, according to the exchange’s incident report.

With deposits unaffected and continuing to flow into Binance 14, the hackers could still initiate transfers.

They ultimately used the same permission to take roughly US$3.6 billion, including the initial US$2.5 billion haul, with US$823 million pulled from another Binance account and four subsequent sweeps of Binance 14, according to a report from blockchain intelligence firm Elliptic.

A Binance spokesperson confirmed that EIP-7702 “played a significant role” in the hack and said the exchange has taken steps to address the risk it exposed. 

“We have revoked the affected delegation, rebuilt the affected wallet infrastructure, and updated our signing and monitoring controls to address this class of authorisation risk,” they said.

“This includes stricter policies around delegation-type transactions, enhanced behavioural monitoring, additional transaction-level controls, and emergency revocation procedures.”

Binance has also strengthened enforcement of access controls so the access path used cannot be repeated, the spokesperson said, adding “user funds remain protected, and Binance has absorbed the financial impact of this incident”.

The episode shows how tools meant to make crypto accounts simpler can also make a breach far more damaging once an intruder gets inside.

The Federal Bureau of Investigation has attributed the attack, the largest cryptocurrency theft on record, to North Korea. Pyongyang has denied any involvement. BLOOMBERG