Blockaid: the Binance hackers stole ~$2.5B, or 40% of the $6.3B haul, in one Ethereum transaction using wallet permissions that cost just $15 in network fees

Wallet delegation now carries an immediate, catastrophic risk for exchanges, requiring new preventative measures.

Hackers stole approximately $2.5 billion worth of cryptocurrency from Binance in a single Ethereum transaction, accounting for 40% of a total $6.3 billion haul. The theft was facilitated by exploiting Ethereum's EIP-7702 upgrade, which allows for wallet permissions to be delegated. The attackers reportedly used a "sophisticated, multi-stage campaign" involving social engineering, tricking an engineer with fake job postings to gain access. They then set up wallet permissions for a nominal network fee of around $15. This permission enabled them to drain a hot wallet, Binance 14, which is used for customer withdrawals, in one swift action. Binance confirmed that EIP-7702 played a significant role and stated that user funds are protected, with Binance absorbing the financial impact. The FBI has attributed the attack to North Korea, a claim denied by Pyongyang.

The exploit of EIP-7702 highlights a critical vulnerability in new blockchain features designed for user convenience, demonstrating how enhanced functionality can also amplify the impact of security breaches. This incident forces a re-evaluation of how such delegation features are implemented and secured, particularly on large exchanges holding vast sums. The speed and scale of this single transaction underscore the increasing sophistication of attack vectors and the necessity for real-time, multi-layered defense mechanisms that can detect and counteract unusual activity before it escalates.

This event signals a potential paradigm shift in how exchanges manage hot wallets and customer withdrawals, demanding immediate improvements in their security protocols around delegated permissions. The revelation that a $15 network fee could unlock billions necessitates a review of internal controls, employee training on social engineering, and the oversight of software upgrades. Future security measures will likely focus on more granular transaction monitoring and rapid revocation capabilities, especially for any form of automated or delegated access.