More details have been revealed about the recent $6.3 billion cryptocurrency theft from Binance.
It is reported that during this major heist, the hacker paid only $15 in network fees, exploited a vulnerability in an Ethereum feature, and transferred $2.5 billion in just three and a half minutes through a single transaction.
According to blockchain transaction records and investigations by security firm Blockaid, the hacker exploited new capabilities introduced by the Ethereum EIP-7702 upgrade.
The upgrade, launched in May 2025, was initially intended to optimize wallet usability by adding features similar to automatic authorization, allowing accounts to authorize software to perform fund operations on their behalf and bundle multiple asset transfers into a single transaction.
Previously, each wallet transfer required individual signature authorization, and transferring multiple tokens involved numerous operations, making it highly likely to trigger exchange risk control alerts.
The hacker used fake job postings to carry out a social engineering attack, tricking an engineer into downloading malicious code. After successfully infiltrating the system, they targeted the hot wallet codenamed "Binance 14."
This wallet serves as Binance's online cash register account for processing user withdrawals and holds large amounts of ETH, stablecoins, and dozens of other tokens.
On October 29 at 20:20 UTC, the hacker submitted an authorization command, paying approximately $15 in network fees, allowing the Ethereum network to permit a malicious program written by the hacker to act on behalf of the Binance 14 wallet. This step did not transfer any funds but granted operational permissions over the assets.
Just three and a half minutes later, the hacker activated a malicious contract and directly stole $2.5 billion worth of assets in a single transaction, including 167,464 ETH and over 60 different tokens, with USDT stablecoin losses alone reaching $1.6 billion.
If traditional methods had been used, transferring dozens of different tokens from the wallet would have required multiple independent transactions, with each operation increasing the likelihood of detection by the security system.
However, EIP-7702's batch execution capability allowed the hacker to empty the wallet with a single click, significantly shortening the time needed for the crime and reducing the chance of being intercepted by risk controls, somewhat embodying the idea of "outsmarting oneself."