Hackers who stole approximately $6.3 billion in cryptocurrency from Binance used a surprisingly inexpensive technique to move billions of dollars in a single transaction. According to blockchain security firm Blockaid, the attackers paid just $15 in Ethereum network fees to activate a malicious wallet permission that allowed their software to transfer approximately $2.5 billion in one transaction. The amount represented around 40% of the total cryptocurrency stolen in the attack.
The November 6 disclosure highlights how a relatively small blockchain transaction fee became part of one of the largest financial thefts ever recorded. The attackers exploited Ethereum’s EIP-7702 functionality, which was designed to make crypto wallets more flexible by allowing software to perform transactions on behalf of an account. However, the $15 transaction was only one stage of a much larger operation involving compromised employees, social engineering, malicious software and access to Binance’s internal wallet infrastructure.
How Hackers Used $15 to Move $2.5 Billion
The attackers exploited a feature introduced through Ethereum Improvement Proposal 7702, commonly known as EIP-7702.
The upgrade allows a regular Ethereum account to temporarily delegate certain execution permissions to software or smart-contract code. This makes it possible to automate transactions and perform multiple wallet operations without requiring separate manual approvals for every action.
The feature is intended to improve wallet usability. However, in the Binance incident, attackers used it to give malicious software the ability to transfer assets from a compromised wallet.
According to Blockaid’s analysis, the hackers submitted a transaction at approximately 8:20 p.m. UTC on October 29 using a valid signature associated with Binance’s hot wallet, known as Binance 14.
The transaction did not immediately transfer cryptocurrency. Instead, it established permission for attacker-controlled code to operate on behalf of the wallet.
The attackers paid approximately $15 in Ethereum network fees to register that permission.
Around three and a half minutes later, they activated the malicious software, which transferred approximately $2.5 billion in cryptocurrency in a single transaction.
The transfer included 167,464 Ether and more than 60 other tokens. Tether’s USDT stablecoin accounted for approximately $1.6 billion of the transaction.
The crucial advantage was speed. Instead of executing dozens of separate transfers requiring individual authorisations, the attackers used the delegated permission to move a large collection of assets together.
The Total Binance Theft Reached $6.3 Billion
Although the $2.5 billion transaction attracted attention because of its low activation cost, it represented only part of the overall attack.
The full incident affected multiple Binance hot wallets across different blockchain networks. Binance estimated that approximately $6.34 billion in digital assets were impacted.
Blockchain intelligence firms have reported slightly different estimates, with Chainalysis identifying approximately $6.4 billion in unauthorised transfers.
According to Elliptic and other blockchain investigators, the attackers used the same EIP-7702 permission to conduct additional transfers, bringing the amount moved through that mechanism to approximately $3.6 billion. Other stolen assets were transferred through separate transactions and wallet infrastructure.
Key figures from the Binance hack
| Indicator | Reported figure |
|---|---|
| Total assets impacted | Approximately $6.34 billion |
| Estimated blockchain analysis | Approximately $6.4 billion |
| Ethereum network fee for delegation | Approximately $15 |
| Largest single transaction | Approximately $2.5 billion |
| Assets moved through the EIP-7702 permission | Approximately $3.6 billion |
| USDT included in the $2.5 billion transfer | Approximately $1.6 billion |
| Assets frozen or intercepted by Binance’s November 3 update | Approximately $2.85 billion |
| Date of attack | October 29, 2026 |
The distinction between the $2.5 billion transaction, the approximately $3.6 billion moved through the permission and the overall $6.34 billion incident is important. They describe different parts of the same security breach.
Fake Job Interviews Helped Hackers Enter Binance
The $15 blockchain transaction was the final execution stage of a campaign that had reportedly been developing for months.
Binance’s initial investigation found that attackers used fake job opportunities and malicious software to compromise employees working in its wallet development team.
The campaign reportedly began in June, when an employee downloaded a compromised version of a development tool. Binance detected suspicious activity, replaced the affected device and changed credentials, but the attackers had already gained knowledge of the employee’s role and internal systems.
A second software engineer was later targeted through what appeared to be a legitimate job interview.
The engineer was reportedly asked to download a malicious code repository as part of an interview assignment. The attackers used the compromised computer to expand their access to internal systems.
Binance also said the attackers exploited an internal AI tool during the campaign to gain control over developers’ systems and wallet-related infrastructure.
By October 20, the attackers had reportedly gained access to systems associated with multiple wallet developers. Nine days later, they used compromised credentials and unauthorised access to an internal wallet-signing service to initiate cryptocurrency transfers outside Binance’s normal withdrawal process.
The incident demonstrates that sophisticated cyberattacks do not always begin with a direct assault on a cryptocurrency wallet. Compromising the people and systems responsible for authorising transactions can provide attackers with a much more effective route into financial infrastructure.
Why Binance Could Not Immediately Stop the Transfers
One of the most concerning aspects of the incident was that suspending withdrawals did not automatically cancel the malicious permission.
Binance initially responded by suspending withdrawals and shutting down affected hot-wallet services. These measures helped contain the incident, but the EIP-7702 authorisation existed directly on the Ethereum blockchain.
Consequently, the permission could continue operating independently of Binance’s normal withdrawal infrastructure.
The exchange also faced technical challenges in revoking the delegation because its wallet infrastructure used multi-party computation, or MPC. This security arrangement distributes signing authority rather than relying on one conventional private key.
Binance had to develop a specialised procedure to remove the malicious authorisation.
The exchange subsequently confirmed that it had revoked the affected delegation, rebuilt the compromised wallet infrastructure and strengthened its transaction-signing and monitoring controls.
Its updated safeguards include stricter rules for delegation-type transactions, enhanced behavioural monitoring, additional transaction-level checks and emergency revocation procedures.
FBI Attributes the Attack to North Korea
The FBI has attributed the Binance incident to North Korea’s state-sponsored cybercrime unit known as TraderTraitor.
The group has previously been associated with major cryptocurrency thefts targeting exchanges, blockchain projects and digital asset companies.
Blockchain analytics firms, including Chainalysis and Elliptic, have also identified links between the stolen funds and North Korean-linked cybercrime activity.
The FBI’s attribution is significant because cryptocurrency theft has become an important source of illicit revenue for North Korean-linked hacking operations.
However, North Korea has rejected allegations of involvement in cyberattacks.
The stolen funds have also created a complex recovery challenge. Cryptocurrency assets such as Bitcoin and Ether cannot generally be frozen by a central issuer in the same way as certain stablecoins.
By contrast, stablecoin issuers such as Tether and Circle can freeze tokens under their respective control mechanisms when they identify addresses associated with illicit activity and receive appropriate requests.
Blockchain investigators have tracked large-scale transfers and attempts to move stolen funds between wallets and convert assets into other cryptocurrencies.
Binance Says Customers Will Not Bear the Losses
Binance has repeatedly said it will absorb the financial impact of the incident rather than pass the losses on to affected customers.
In its November 3 security update, the exchange said it had set aside more than 100% of the funds required to cover the loss. It also reported that approximately 98% of impacted token assets had been replenished and could be verified through its Proof of Reserves disclosures as of October 31.
The exchange said approximately $2.85 billion in assets had been frozen or intercepted, subject to reconciliation and changes in market prices.
Binance also used company resources and its Secure Asset Fund for Users (SAFU) to support the recovery process.
The response was important for maintaining customer confidence. Reuters reported that customers withdrew approximately $3.64 billion after the exchange resumed operations following the attack, representing around 2.1% of its assets.
Although the initial withdrawal surge highlighted concerns about the incident, Binance subsequently said withdrawal activity was stabilising.
The Bigger Picture
The Binance hack exposes a growing security challenge for cryptocurrency platforms: features designed to make digital wallets more convenient can create additional risks when attackers gain control of the systems that authorise transactions.
EIP-7702 was not designed as a theft mechanism. Its functionality can support useful wallet automation, but the incident demonstrates how delegated permissions can become dangerous when they are granted through compromised signing infrastructure. The attack also highlights the importance of employee cybersecurity, software supply-chain controls and monitoring of unusual wallet authorisations.
The $15 fee should not distract from the sophistication of the operation. The attackers needed months of preparation, access to employee systems and knowledge of Binance’s internal wallet processes. The low transaction cost was simply the final step that enabled a massive transfer.
Looking Ahead
Binance’s next challenge will be to demonstrate that the security changes introduced after the incident can prevent similar attacks. The exchange has already revoked the affected delegation, rebuilt compromised infrastructure and strengthened transaction monitoring. However, the broader cryptocurrency industry will need to review how delegated wallet permissions, employee devices and internal signing services are protected. Exchanges using similar wallet technologies may also reassess how quickly they can revoke authorisations during an emergency.
The incident could influence how Ethereum-based wallets and exchanges implement account delegation in the future. Developers may introduce stricter permission limits, shorter authorisation periods, transaction-value restrictions and faster emergency revocation mechanisms. For cryptocurrency investors, the episode is a reminder that blockchain transparency does not automatically guarantee wallet security. The technology can record every transaction publicly, but protecting the systems that authorise those transactions remains a critical responsibility.
Get the day’s top stories in your inbox
One concise email. No spam, unsubscribe anytime.
