Binance hackers used $15 Ethereum fee to move $2.5 billion

The hackers behind the record theft from Binance paid about $15 in network fees to set up a permission that let them take roughly $2.5 billion in one transaction. That single transfer was about 40% of everything stolen, Bloomberg reported via The Straits Times, citing security firm Blockaid. The attack exploited EIP-7702, an Ethereum ↘ 0.47% feature meant to make wallets easier to use. It let the attackers move more than 60 kinds of tokens at once, so they did not need a series of separate transfers that security systems might have caught.straitstimes.com

How the attack worked

Binance laid out a timeline on November 3 describing a "sophisticated, multi-stage campaign." Fake job postings tricked an engineer into downloading malicious code, which gave the attackers a way in. From there they targeted a hot wallet called Binance 14, which the exchange uses to process customer withdrawals, according to the report. At about 8:20 p.m. UTC on October 29, the hackers used a valid signature from the wallet to let code they controlled act on its behalf. About three and a half minutes later, that code moved 167,464 Ether and more than 60 other tokens, including about $1.6 billion in USDT Tether stablecoin, India Today reported.indiatoday.in+1

Because the permission was recorded on Ethereum itself, shutting off withdrawals did not cancel it. Deposits kept flowing into the wallet, and the attackers could keep sweeping it. Blockchain intelligence firm Elliptic estimated they used the same permission to take about $3.6 billion in total, including $823 million from a second Binance account. "EIP-7702 helped the hackers move faster and maintain control of the wallet even after Binance detected the breach," Hypernative co-founder Dan Caspi said.straitstimes.com

Binance's response

A Binance spokesperson confirmed that EIP-7702 "played a significant role" in the hack. "We have revoked the affected delegation, rebuilt the affected wallet infrastructure, and updated our signing and monitoring controls to address this class of authorisation risk," the spokesperson said. Binance estimated the total loss at about $6.3 billion and said about $3 billion had been frozen on-chain, ABC News reported. The exchange also said it had replaced 90% of the stolen amount using its own money, according to NBC News. It started reopening withdrawals in phases on November 1, SecurityWeek reported.abcnews.com+3

North Korea blamed

On October 31, the FBI said North Korea was responsible for the theft. It blamed a group it calls "TraderTraitor" and said the hackers were converting the stolen assets mainly into Ether. The same group was behind last year's $1.5 billion hack of the Bybit exchange, the AP reported. On November 3, Pyongyang denied any role and called the US accusation "a trite provocation," according to the AP.fbi.gov+2