Hackers Gain Control of Binance Wallet for $15 Fee and Withdraw $2.5 Billion

Bloomberg, citing an investigation by cybersecurity firm Blockaid, reported that the attack on the Binance 14 hot wallet cost hackers approximately $15 in Ethereum network fees. This amount was enough to gain control over the wallet and withdraw assets worth $2.5 billion. Binance 14 was used for client withdrawals.

The attackers utilized EIP-7702, a mechanism introduced in Ethereum with the Pectra update in May 2025. It allows regular wallets to delegate the right to execute operations to smart contracts, so the user does not have to sign each action. If the storage management system is compromised, the mechanism allows for multiple transfers without additional confirmations.

On October 29 at around 20:20 UTC, the attackers sent a transaction with 50 EIP-7702 permissions, signed by the compromised Binance infrastructure. Each permission corresponded to a specific wallet operation sequence number. The address was constantly active, so the attackers did not know which signature would work; one turned out to be valid. Control of the wallet was transferred to the malicious smart contract, and the hackers paid about $15 for setting up the delegation. The operation itself did not involve the transfer of funds but granted access to Binance 14's assets.

Three minutes and 24 seconds later, at 20:24 UTC, the attackers activated the contract and in a single transaction withdrew 167,464 ETH, about 1.615 billion USDT, and approximately 60 other tokens. The total value of the stolen assets was around $2.5 billion. Dan Caspi, CTO of Hypernative, explained to Bloomberg that EIP-7702 allowed for a swift withdrawal and maintained control over the wallet even after the attack was detected.

The permission was valid on the Ethereum network independently of the exchange's internal systems. As new funds were sent to the Binance 14 address, the attackers could withdraw them without regaining access to the signing system. According to analytics firm Elliptic, using this mechanism, the hackers moved about $3.6 billion, including the initial $2.5 billion; another $823 million was withdrawn from another Binance wallet. The last unauthorized transfer occurred at 23:56 UTC on October 29, and the delegation was removed at 00:10 UTC the next day.

A Binance representative confirmed to Bloomberg that EIP-7702 played a significant role. According to him, the exchange revoked the malicious permissions, restructured the affected infrastructure, strengthened control over transaction signing, and implemented monitoring and emergency revocation tools. The attack was not related to a breach of Ethereum cryptography: valid permissions obtained due to the compromise of Binance's internal systems were used. About $2.85 billion was frozen or intercepted with the help of token issuers and other industry participants; Binance assumed the financial consequences.

The Federal Bureau of Investigation (FBI) blamed the North Korean group TraderTraitor, linked to Lazarus. North Korean authorities denied the accusations. After the resumption of swaps on THORChain, wallets associated with the hack continued to convert the stolen funds into Bitcoin.