Hackers paid US$15 to drain US$2.5 billion from Binance in one hit

Sidhartha Shukla / Bloomberg11-06

The hackers who stole US$6.3 billion from Binance last week found a way to take 40% of the stolen cryptocurrency in one hit, reducing their chances of being caught in the act, and it cost them just......

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Comments

We need your insight to fill this gap

Leave a comment

{"i18n":{"language":"en_US"},"isChannel":false,"data":{"share":"https://ttm.financial/m/news/2681893295?lang=en_US&edition=fundamental","thumbnail":"","is_english":true,"pubTime":"2026-11-06 04:22","share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","id":"2681893295","market":"sg","top_or_hot":-1,"title":"Hackers paid US$15 to drain US$2.5 billion from Binance in one hit","media":"Sidhartha Shukla / Bloomberg","content":"<div>\n<p>The hackers who stole US$6.3 billion from Binance last week found a way to take 40% of the stolen cryptocurrency in one hit, reducing their chances of being caught in the act, and it cost them just......</p>\n\n<a href=\"https://www.theedgesingapore.com/news/tech/hackers-paid-us15-drain-us25-billion-binance-one-hit?utm_source=Blog&utm_medium=RSS&utm_campaign=Tiger_Brokers_app_RSS\">Source Link</a>\n\n</div>\n","source":"edge_highlight","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>Hackers paid US$15 to drain US$2.5 billion from Binance in one hit</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nHackers paid US$15 to drain US$2.5 billion from Binance in one hit\n</h2>\n\n<h4 class=\"meta\">\n\n\n2026-11-06 04:22 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://www.theedgesingapore.com/news/tech/hackers-paid-us15-drain-us25-billion-binance-one-hit?utm_source=Blog&utm_medium=RSS&utm_campaign=Tiger_Brokers_app_RSS><strong>Sidhartha Shukla / Bloomberg</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>The hackers who stole US$6.3 billion from Binance last week found a way to take 40% of the stolen cryptocurrency in one hit, reducing their chances of being caught in the act, and it cost them just......</p>\n\n<a href=\"https://www.theedgesingapore.com/news/tech/hackers-paid-us15-drain-us25-billion-binance-one-hit?utm_source=Blog&utm_medium=RSS&utm_campaign=Tiger_Brokers_app_RSS\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":"ETHW","symbol_name":"以太坊ETF-Bitwise","start_time":0,"source_url":"https://www.theedgesingapore.com/news/tech/hackers-paid-us15-drain-us25-billion-binance-one-hit?utm_source=Blog&utm_medium=RSS&utm_campaign=Tiger_Brokers_app_RSS","article_id":"2681893295","we_media_id":null,"thumbnails":[],"rights":{"source":"edge_highlight","url":"https://www.theedgesingapore.com/news/tech/hackers-paid-us15-drain-us25-billion-binance-one-hit?utm_source=Blog&utm_medium=RSS&utm_campaign=Tiger_Brokers_app_RSS","rn_cache_url":null,"directOrigin":true},"url":"https://stock-news.laohu8.com/highlight/detail?id=2681893295","pubTimestamp":1793910158,"columns":[],"sourceInfo":{"source_id":"edge_highlight","name":"Edge"},"weMediaInfo":null,"summary":"The hackers who stole US$6.3 billion from Binance last week found a way to take 40% of the stolen cryptocurrency in one hit, reducing their chances of being caught in the act, and it cost them just...","collect":0,"end_time":0,"defaultTopTitle":"theedgesingapore.com","property":[],"viewcount":null,"language":"en","relate_stocks":{"ETHW":"以太坊ETF-Bitwise","ETHA":"以太坊ETF-iShares","CBTJ":"Calamos Bitcoin 80 Series Structured Alt Protection ETF - January","BTRN":"比特币期货ETF-Global X","LFGY":"YieldMax Crypto Industry and Tech Portfolio Option Income ETF","BITY":"Amplify Bitcoin 2% Monthly Option Income ETF","FETH":"以太币ETF-Fidelity","GDLC":"Grayscale CoinDesk Crypto 5 ETF","CBOO":"Calamos Bitcoin Structured Alt Protection ETF - October","MAXI":"比特币期货ETF-Simplify","BETE":"等权重比特币&以太币期货ETF-ProShares","SETH":"1倍做空以太币期货ETF-Proshares","FBTC":"比特币ETF-Fidelity","CBTO":"Calamos Bitcoin 80 Series Structured Alt Protection ETF - October","YETH":"Roundhill Ether Covered Call Strategy ETF","ETHD":"ProShares UltraShort Ether ETF","BRRR":"比特币ETF-CoinShares","BETH":"比特币&以太币期货ETF-ProShares","ETHE":"最大以太坊ETF-Grayscale","EZET":"以太坊ETF-Franklin","QETH":"以太坊ETF-Invesco Galaxy","BTF":"比特币&以太币期货ETF-CoinShares","CRPT":"First Trust SkyBridge Crypto Industry and Digital Economy ETF","STCE":"Schwab Crypto Thematic ETF","ETH":"低成本以太坊ETF-Grayscale","CBOY":"Calamos Bitcoin Structured Alt Protection ETF - July","ETCO":"Grayscale Ethereum HIGH Income ETF","BTCZ":"T-Rex 2X Inverse Bitcoin Daily Target ETF","MNRS":"GRAYSCALE BITCOIN MINERS ETF","BAGY":"Amplify Bitcoin Max Income Covered Call ETF","ETTY":"Amplify Ethereum 3% Monthly Option Income Etf","BITQ":"Bitwise Crypto Industry Innovators ETF","BTC":"Grayscale Bitcoin Mini Trust","BFAP":"FT Vest Bitcoin Strategy Floor15 ETF - April","ARKY":"ARK Active Autocallable Income ETF","TEKX":"SPDR Galaxy Transformative Tech Accelerators ETF","ETU":"T-Rex 2X Long Ether Daily Target ETF","CBXY":"Calamos Bitcoin 90 Series Structured Alt Protection ETF - July","ETHU":"2倍以太币期货ETF-Volatility Shares","BITU":"2倍做多比特币期货ETF-Proshares","ETQ":"T-Rex 2X Inverse Ether Daily Target ETF","BCCC":"Global X Bitcoin Covered Call ETF","BTCI":"NEOS Bitcoin High Income ETF","HODL":"比特币ETF-VanEck","BKCH":"AdvisorShares Sabretooth ETF","ESK":"REX-Osprey ETH + Staking ETF","ETHV":"以太坊ETF-VanEck","DIME":"CoinShares Altcoins ETF","BITW":"Bitwise 10 Crypto Index ETF","EETH":"以太币期货ETF-ProShares"},"translate_title":"黑客支付15美元一举从币安抽走25亿美元","themeId":null,"isJumpTheme":false,"ttsUrl":null,"symbols_score_info":{"LFGY":0.9,"CBOY":0.6,"CBXY":0.6,"BCCC":0.6,"MAXI":0.6,"ETHW":0.88,"CBOO":0.6,"ETTY":0.7,"ARKY":0.7,"STCE":0.9,"BITW":0.9,"BKCH":0.9,"SETH":0.6,"ESK":0.6,"MNRS":0.6,"BTCI":0.6,"FBTC":0.6,"CBTO":0.6,"ETCO":0.6,"BITU":0.6,"ETQ":0.6,"GDLC":0.9,"BTCZ":0.6,"CRPT":0.9,"HODL":0.6,"BTC":0.6,"BITQ":0.9,"BFAP":0.6,"EETH":0.88,"BTRN":0.6,"ETHE":0.88,"TEKX":0.7,"BAGY":0.6,"BITY":0.6,"BRRR":0.6,"ETU":0.88,"BETH":0.88,"ETHU":0.88,"ETHV":0.88,"ETHA":0.88,"BETE":0.88,"EZET":0.88,"DIME":0.7,"ETH":0.88,"BTF":0.88,"CBTJ":0.6,"YETH":0.88,"QETH":0.88,"FETH":0.7,"ETHD":0.68},"content_text":"The hackers who stole US$6.3 billion from Binance last week found a way to take 40% of the stolen cryptocurrency in one hit, reducing their chances of being caught in the act, and it cost them just...(Nov 6): The hackers who stole US$6.3 billion from Binance last week found a way to take 40% of the stolen cryptocurrency in one hit, reducing their chances of being caught in the act, and it cost them just US$15.\n\nAn examination of transactions recorded on the Ethereum blockchain shows how the thieves weaponised a feature designed to make crypto wallets easier to use. It allows an account to give software permission to move money on its behalf, rather than requiring separate authorizations for each transfer.\nThe hackers paid about US$15 in network fees to put that permission in place, then used it to take roughly US$2.5 billion in a single transaction - 40% of the total amount stolen - according to security firm Blockaid.\nOn Tuesday, Binance itself outlined an elaborate timeline in which infiltrators used phony job postings to deceive an engineer into downloading malicious code. It was a \"sophisticated, multi-stage campaign,\" according to the exchange, replete with social engineering, compromised devices and AI techniques.\n\nOnce inside, the hackers targeted a \"hot wallet\" known as Binance 14, which the exchange uses to process customer withdrawals, records on the Etherscan analytics platform show. This wallet is a bit like an online cash register, and because Binance is the world's largest crypto exchange, it regularly holds large pools of Ether, stablecoins and dozens of other digital tokens.\n\nShortcut\nMoving so many different assets would ordinarily require a series of separate transfers, each taking time and creating another chance for security systems to spot something unusual.\nBut an Ethereum software upgrade known as EIP-7702 offered a shortcut. \nBefore it was implemented in May 2025, a basic crypto wallet was more akin to a checking account, where the owner generally had to sign off on each transaction. The upgrade added something closer to an autopay function, letting a wallet give software the ability to act on its behalf and bundle several actions together.\nAt about 8:20 p.m. UTC on Oct 29, the hackers submitted instructions using a valid signature from the Binance 14 wallet telling the Ethereum network to let attacker-controlled code act on the account's behalf, according to Blockaid. It's at this point that they paid the routine network processing fee to put that authority in place.\nThat transaction moved no money, it simply told Ethereum to let the hackers' software act for the wallet.\n\"The program does one thing: when its owner asks, it empties the wallet into an address of the owner's choosing,\" blockchain research firm Tibane Labs said in a report.\nThree and a half minutes later, the hackers triggered the trap. Operating under the new permissions, the attacker's software moved roughly US$2.5 billion in a single transaction, according to Blockaid. The haul included 167,464 Ether and more than 60 other tokens, led by US$1.6 billion in Tether's USDT stablecoin.\nFaster getaway\n\"In an attack, the defender wants to slow the attacker down,\" said Dan Caspi, co-founder and chief technology officer at Hypernative. \"EIP-7702 helped the hackers move faster and maintain control of the wallet even after Binance detected the breach.\" \nBecause the permission lived on Ethereum, Binance turning off withdrawals or shutting down its hot-wallet services did not automatically cancel it, according to the exchange's incident report.\nWith deposits unaffected and continuing to flow into Binance 14, the hackers could still initiate transfers. They ultimately used the same permission to take roughly $3.6 billion, including the initial $2.5 billion haul, with $823 million pulled from another Binance account and four subsequent sweeps of Binance 14, according to a report from blockchain intelligence firm Elliptic.\nA Binance spokesperson confirmed that EIP-7702 \"played a significant role\" in the hack and said the exchange has taken steps to address the risk it exposed. \n\"We have revoked the affected delegation, rebuilt the affected wallet infrastructure, and updated our signing and monitoring controls to address this class of authorization risk,\" they said. \"This includes stricter policies around delegation-type transactions, enhanced behavioral monitoring, additional transaction-level controls, and emergency revocation procedures.\"\nBinance has also strengthened enforcement of access controls so the access path used cannot be repeated, the spokesperson said, adding \"user funds remain protected, and Binance has absorbed the financial impact of this incident.\"\nThe episode shows how tools meant to make crypto accounts simpler can also make a breach far more damaging once an intruder gets inside.\nThe FBI has attributed the attack, the largest cryptocurrency theft on record, to North Korea. Pyongyang has denied any involvement.\nUploaded by Liza Shireen Koshy","kind":"highlight","is_publish_news":true,"is_publish_highlight":false,"is_publish_live":false,"is_publish_wemedia":false,"editions":null,"column":"","sentiment":"-1","news_tag":"","news_rank":0,"isVideo":false,"video":null,"symbols":[],"gpt_button":0,"need_auth":false,"need_login_tip":false,"code":"91000000","status":"200"},"commentList":[],"isCommentEnd":true,"newsSizeData":{"likeSize":0,"commentSize":0,"repostSize":0,"favoriteSize":0,"likeStatus":false,"favoriteStatus":false},"APP":{"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","isDev":false,"isTTM":true,"isLaohu8Offline":false,"tenantId":"TBGLOBAL","deviceId":"web-server-community-laohu8-v3","version":"4.53.0","shortVersion":"4.53.0","platform":"web","vendor":"web","appName":"ttm","isIOS":false,"isAndroid":false,"isTiger":false,"isTHS":false,"isWeiXin":false,"isWeiXinMini":false,"isWeiBo":false,"isQQ":false,"isBaiduSwan":false,"isBaiduBox":false,"isDingTalk":false,"isToutiao":false,"isOnePlus":false,"isHuaWei":false,"isXiaomi":false,"isXiaomiWebView":false,"isOppo":false,"isVivo":false,"isSamsung":false,"isMobile":false},"href":"/m/news/2681893295","isCrawlerRequest":true}