Hackers paid US$15 to drain US$2.5b from Binance in one hit

Hackers suspected to be operating out of North Korea stole US$6.3 billion (S$8 billion) from Binance on Oct 29.

SAN FRANCISCO – The hackers who stole US$6.3 billion (S$8 billion) from Binance found a way to take 40% of the stolen cryptocurrency in one hit, reducing their chances of being caught in the act, and it cost them just US$15.

An examination of transactions recorded on the Ethereum blockchain shows how the thieves weaponised a feature designed to make crypto wallets easier to use. It allows an account to give software permission to move money on its behalf, rather than requiring separate authorisations for each transfer.

The hackers paid about US$15 in network fees to put that permission in place, then used it to take roughly US$2.5 billion in a single transaction – 40% of the total amount stolen – according to security firm Blockaid.

On Nov 3, Binance itself outlined an elaborate timeline in which infiltrators used phoney job postings to deceive an engineer into downloading malicious code. It was a “sophisticated, multi-stage campaign”, according to the exchange, replete with social engineering, compromised devices and AI techniques.

Once inside, the hackers targeted a “hot wallet” known as Binance 14, which the exchange uses to process customer withdrawals, records on the Etherscan analytics platform show.

This wallet is a bit like an online cash register, and because Binance is the world’s largest crypto exchange, it regularly holds large pools of Ether, stablecoins and dozens of other digital tokens.

Moving so many different assets would ordinarily require a series of separate transfers, each taking time and creating another chance for security systems to spot something unusual.

Before it was implemented in May 2025, a basic crypto wallet was more akin to a current account, where the owner generally had to sign off on each transaction.

The upgrade added something closer to an autopay function, letting a wallet give software the ability to act on its behalf and bundle several actions together.

At about 8.20pm UTC on Oct 29 (4.20am on Oct 30, Singapore time), the hackers submitted instructions using a valid signature from the Binance 14 wallet telling the Ethereum network to let attacker-controlled code act on the account’s behalf, according to Blockaid. It is at this point that they paid the routine network processing fee to put that authority in place.

That transaction moved no money. It simply told Ethereum to let the hackers’ software act for the wallet.