In a stunning development, hackers managed to gain access to an eye-popping $2.5 billion, costing them a mere $15, marking it as the largest cryptocurrency theft ever recorded. This audacious heist targeted Binance, where the perpetrators exploited a specialized Ethereum feature to siphon off nearly 40% of their total loot in a single transaction. This incident was part of a larger, sophisticated cyberattack that resulted in an estimated $6.3 billion in digital assets being stolen from Binance, according to Bloomberg reports. The FBI has linked this breach to North Korea.Binance revealed that the attack commenced when an employee fell victim to a fraudulent job listing and unwittingly downloaded malicious software, allowing hackers access to internal systems. Following this breach, the attackers executed a high-level exploit of Ethereum’s core functionalities, enabling them to transfer vast sums while Binance scrambled to secure its platform.
The $15 Transaction That Cleared the Vault
The hackers primarily targeted Binance 14, a hot wallet that the platform uses for everyday customer withdrawals. This wallet, directly linked to online services, contained significant amounts of Ether, stablecoins, and various alternative tokens. After compromising Binance’s signing infrastructure, the attackers obtained a valid cryptographic signature from the Binance 14 wallet. At approximately 8:20 p.m. UTC on October 29, they sent commands to the Ethereum network, paying just around $15 in typical gas fees.However, this $15 transaction did not involve the movement of any cryptocurrency. Instead, it authorized the hackers’ software access to operate the wallet.This minimal expense underscores the nature of public blockchains: Ethereum’s processing costs are determined by the computational resources required for executing instructions and the overall demand on the network—not by the value of the tokens in an account. Thus, changing access permissions for an account containing billions costs the same as doing so for one with just a few dollars.About three and a half minutes later, the attackers executed their software, resulting in a single, massive transfer of roughly $2.5 billion.This rapid extraction was made possible by EIP-7702, an Ethereum upgrade proposal that was introduced on May 7, 2025, during a network enhancement known as Pectra.Available for around 18 months, EIP-7702 was aimed at enhancing user experience by giving standard crypto wallets programmable features, including the ability to bundle multiple operations into a single action or allow third parties to cover transaction fees. In simpler terms, it’s akin to designating a concierge empowered to manage multiple tasks without needing prior approval for each one.Security experts note that EIP-7702 did not independently create vulnerabilities; the hackers had already infiltrated Binance’s systems and compromised its signing capabilities. Nevertheless, this feature enabled their code to effectively take control of the Binance 14 wallet.Utilizing EIP-7702’s bundling functions, the hackers executed a consolidated withdrawal that cleared 167,464 Ether and over 60 additional cryptocurrencies, including approximately $1.6 billion worth of Tether (USDT)—bringing the total amount to around $2.5 billion.