Hackers exploited a feature in the Ethereum blockchain to steal US$2.5 billion in a single transaction from Binance, part of a larger US$6.3 billion heist. The thieves used a software upgrade called EIP-7702, which allows wallets to grant permission for automated transactions, to bypass Binance’s security measures. This feature, designed to simplify crypto transactions, enabled the hackers to move funds faster and avoid detection. The attack began when infiltrators tricked a Binance engineer into downloading malicious code through phoney job postings.
The hackers targeted Binance’s hot wallet, known as Binance 14, which holds large amounts of cryptocurrencies for customer withdrawals. Normally, moving multiple assets would require separate transfers, increasing the risk of detection. However, EIP-7702 allowed the hackers to bundle transactions, moving 167,464 Ether and over 60 other tokens, including US$1.6 billion in Tether’s USDT stablecoin, in one go. The entire operation cost the hackers just US$15 in network fees.
Binance confirmed that EIP-7702 played a significant role in the breach and has since taken steps to mitigate the risk. The exchange revoked the affected permissions, rebuilt its wallet infrastructure, and implemented stricter controls. Despite the attack, Binance assured that user funds remain protected and that it has absorbed the financial impact. The US Federal Bureau of Investigation has attributed the attack to North Korea, though Pyongyang has denied involvement.