A $15 Fee Preceded Authorization That Enabled $2.5 Billion Transfer From Binance Wallet
Key Facts
An authorization on the Ethereum network enabled the transfer of about $2.5 billion in assets from a Binance wallet in a single transaction on Oct. 29, after the attackers paid about $15 in network fees to activate it, according to Blockaid in a report cited by Bloomberg via The Edge Malaysia. The transfer represented about 40% of the total amount stolen in the incident, the security firm said. Binance said the attacker exploited unauthorized access to an internal signing service to launch transactions outside the usual withdrawal process. The report described the authorization as a step that enabled the assets to be moved after the signing service was compromised. Binance later estimated the value of all assets affected in the incident at about $6.34 billion, a broader estimate than the value of the single transfer.
CoinDesk said the attacker carried out the transfer at 20:24:23 UTC, moving about 167,464 ETH and 63 tokens, including nearly $1.6 billion in USDT. The assets were consolidated in a single transaction through what the report described as a “sweeper” contract called from Binance Wallet 14. Blockaid said monitoring systems issued an alert 1 minute and 55 seconds after the transfer. The firm also detected subsequent movements across networks within seven seconds of each movement. These events show how quickly the assets moved, while the on-chain authorization enabled the transaction outside the usual internal withdrawal controls, according to Binance’s description of the breach.
Binance said suspending withdrawals did not stop all movements because the malicious EIP-7702 authorizations were recorded on-chain and operated independently of the usual withdrawal infrastructure. The company added that the hot wallet used multiparty computation, known as MPC, so there was no single private key that could be used immediately to revoke the authorization. Binance Wallet 14 remained under the malicious authorization for about four hours before it was revoked at 00:10:35 UTC on Oct. 30, according to CoinDesk. Binance’s initial response included suspending withdrawals and coordinating to freeze the affected assets. Reuters reported that those steps resulted in about $2.85 billion being frozen.
In an update published on Nov. 3, Binance estimated the assets affected by the incident at about $6.34 billion and said about $2.85 billion had been frozen or intercepted by the time of the update. It added that 98% of the affected token assets had been replenished by that date. The company said it would absorb the financial impact of the stolen funds rather than pass it on to users, and that it had allocated more than 100% of the funds needed to cover the loss. In an earlier update, it said the funds allocated for coverage were sufficient to cover 90% of the lost assets by Nov. 1, while pledging to fully compensate customers. Binance’s estimate of the affected assets differs from the value of the single Ethereum transaction, which was about $2.5 billion.
Binance attributed the incident to a multistage campaign involving fake job interviews, malware downloads and the compromise of internal tools, and said access to wallet-signing operations was used on Oct. 29. It added that its security team had detected and blocked 57 suspected cyberthreat incidents linked to North Korea during 2026. The FBI attributed the theft of more than $6 billion from Binance on that date to North Korea, using the name TraderTraitor to refer to this cyber activity. The bureau said the stolen assets were being converted primarily into ether and that it expected subsequent attempts to move them through decentralized finance and instant-swap services. The FBI urged cryptocurrency platforms, blockchain analytics firms and others to block transactions linked to specified addresses.
EIP-7702 allows regular accounts to add smart-contract functionality through execution delegation, according to Ethereum.org guidance. The guidance warns that delegating an account, without its owner’s knowledge, to a malicious contract could give an attacker the ability to control and steal assets. The proposal was included in the Pectra upgrade, which was activated on the Ethereum mainnet on May 7, 2025. Binance said it revoked the affected authorization and rebuilt its wallet infrastructure, while updating signing and monitoring controls. It added that the investigation was ongoing and its findings would undergo an independent review, while the FBI said asset transfers through decentralized finance and instant-swap services could come in later stages.