Binance hack: How hackers moved billions in crypto with a $15 transaction
Hackers who stole cryptocurrency worth $6.3 billion from Binance used an Ethereum feature to move around $2.5 billion in a single transaction after paying just $15 in network fees, reported Bloomberg.
The attackers exploited a feature called EIP-7702, which allows a cryptocurrency wallet to authorise software to carry out transactions on its behalf. The feature was introduced to make crypto wallets easier to use, but the hackers used it to move a large amount of stolen cryptocurrency quickly, reducing the chances of being caught during multiple transactions.
According to the report, hackers first gained access to Binance through a sophisticated campaign involving fake job postings. The attackers allegedly tricked an engineer into downloading malicious code, compromising devices and gaining access to the exchange's systems.
They then targeted a hot wallet called Binance 14, which the exchange uses to process customer withdrawals and which holds large amounts of cryptocurrencies.
An examination of transactions on the Ethereum blockchain showed how the attackers used EIP-7702 to authorise software to move funds from the compromised wallet.
At around 8.20 pm UTC on October 29, the hackers submitted instructions using a valid signature from the Binance 14 wallet. This allowed attacker-controlled software to act on the wallet's behalf.
The transaction did not immediately move any cryptocurrency. Instead, it gave the software permission to access and transfer funds. The hackers paid around $15 in network fees to set up this authorisation, Bloomberg reported, citing blockchain security firm Blockaid.
Around three-and-a-half minutes later, they used that permission to transfer approximately $2.5 billion in a single transaction.
The amount included 167,464 Ether and more than 60 other tokens. The largest component was Tether's USDT stablecoin, worth around $1.6 billion.
Ordinarily, moving several types of cryptocurrency would require multiple transactions. Each transfer would take time and create another opportunity for security systems to flag suspicious activity. The Ethereum feature allowed the hackers to combine these actions and move the funds much faster.WHY BINANCE COULD NOT IMMEDIATELY STOP THE TRANSFERS
The attack also exposed a weakness in how permissions granted through EIP-7702 work.
Since the authorisation was recorded on the Ethereum blockchain, shutting down Binance's hot-wallet services did not automatically cancel it. This meant the attackers could continue initiating transfers even after Binance detected the breach.
According to blockchain intelligence firm Elliptic, the hackers ultimately used the same permission to move around $3.6 billion, including the initial $2.5 billion. This included $823 million taken from another Binance account and four subsequent transfers from Binance 14.
The continued flow of deposits into Binance 14 also meant that funds remained available to be moved using the permission already granted.WHAT HAS BINANCE SAID?
Binance acknowledged that EIP-7702 played a significant role in the incident and said it had taken steps to address the security risk.
The exchange said it had revoked the affected authorisation, rebuilt the affected wallet infrastructure and updated its signing and monitoring controls.
It has also introduced stricter rules for transactions involving delegated permissions, enhanced behavioural monitoring, additional transaction-level checks and emergency procedures to revoke such permissions.
Binance said user funds remain protected and that it had absorbed the financial impact of the incident.
The FBI has attributed the attack, described as the largest cryptocurrency theft on record, to North Korea. Pyongyang has denied any involvement.
The incident highlights how features designed to make cryptocurrency transactions simpler can also create significant risks if attackers gain access to a wallet. It also raises questions about how exchanges monitor permissions granted to external software and whether their security systems can respond quickly enough once such access is compromised.- Ends
