Imagine having to spend just $15 to unlock access to $2.5 billion, and then moving the entire fortune in a matter of seconds. That is essentially what happened in the massive cryptocurrency theft from Binance, where hackers exploited an Ethereum feature to transfer approximately 40% of the stolen money in one transaction. The extraordinary part was not just the amount they managed to move, but how little it cost them to establish the permission that made it possible. According to blockchain security firm Blockaid, the attackers paid approximately $15 in Ethereum network fees before using the authorization to transfer the enormous haul.
The attack was part of a sophisticated operation that resulted in approximately $6.3 billion worth of cryptocurrency being stolen from Binance, making it the largest cryptocurrency theft on record, as reported by Bloomberg. The FBI has attributed the attack to North Korea, although Pyongyang has denied any involvement. According to Binance, the attackers used fake job postings to trick an engineer into downloading malicious code, eventually gaining access to the exchange’s systems. What followed was an unusual exploitation of Ethereum technology that allowed the hackers to move billions of dollars even as Binance attempted to contain the breach.
The $15 transaction that unlocked billions
The hackers initially targeted Binance 14, a major online wallet that the exchange uses to process customer withdrawals. As a hot wallet connected to online systems, it regularly holds substantial amounts of Ether, stablecoins, and dozens of other digital tokens. After compromising the exchange’s signing infrastructure, the attackers used a valid signature from Binance 14 to submit instructions to the Ethereum network at approximately 8:20 p.m. UTC on October 29. They paid roughly $15 in routine network processing fees to register permission for their own software to operate through the wallet. Crucially, that initial transaction did not transfer a single cryptocurrency token, as it simply changed who was authorized to control the wallet.
Why did something that eventually involved billions of dollars cost so little? Ethereum processing fees are determined by the computational work required to execute an instruction and the demand on its network, rather than the monetary value of the assets affected. Registering permission over a wallet containing billions therefore does not necessarily cost more than making a comparable change to an account holding a much smaller amount. The $15 was paid to the Ethereum network for processing the authorization, not to Binance, a hacker intermediary, or an anonymity service. Approximately three and a half minutes after establishing the permission, the attackers activated their software and transferred roughly $2.5 billion in a single transaction.
The shortcut came from EIP-7702, a feature introduced through Ethereum’s Pectra upgrade on May 7, 2025. It allows conventional cryptocurrency wallets to adopt programmable behavior, including bundling multiple operations and allowing another party to sponsor transaction fees. Think of it as giving a concierge permission to handle several errands without having to approve every individual task. In this case, compromised signing infrastructure allowed attacker-controlled software to act on behalf of Binance 14. The feature had been available for approximately 18 months and was originally designed to make cryptocurrency wallets easier to use, not to facilitate large-scale theft. However, it is important to understand that EIP-7702 did not independently give strangers access to Binance’s wallet, as the attackers had already penetrated the exchange’s systems.
One transaction moved more than 60 cryptocurrencies
The initial transfer contained 167,464 Ether and more than 60 other cryptocurrency tokens, including approximately $1.6 billion worth of Tether’s USDT stablecoin. The total value came to roughly $2.5 billion, representing around 40% of the entire $6.3 billion theft. Moving such a diverse collection of assets would ordinarily require multiple transactions, each creating another opportunity for security systems to flag suspicious activity. EIP-7702 allowed the attackers to bundle the operation and execute the massive transfer in one go, making it considerably harder for Binance to intervene before the assets moved.
Even after detecting the breach, Binance could not immediately stop the attackers because the authorization existed directly on Ethereum. Disabling withdrawals or shutting down its hot-wallet services did not automatically cancel the permission, while deposits into Binance 14 continued to flow in. According to blockchain intelligence firm Elliptic, the attackers eventually used the same authorization mechanism to transfer approximately $3.6 billion, including the initial $2.5 billion, another $823 million from a separate Binance account, and four subsequent sweeps of Binance 14.
Binance has since revoked the affected delegation, rebuilt its wallet infrastructure, and strengthened its signing, monitoring, and emergency revocation controls. The exchange also said customer funds remained protected and that it had absorbed the financial impact of the incident. The episode exposes an uncomfortable side of making cryptocurrency easier to use, where a feature designed to save users time can also give attackers a much faster way to exploit compromised accounts.
