Binance Hack: Hackers Paid $15 to Steal $2.5B

The Binance hack just got a lot more unsettling, because new blockchain forensics show the thieves needed only about fifteen dollars in network fees to set up a theft worth billions. Bloomberg's reporting, carried by The Straits Times, lays out how a convenience feature became the getaway car.

Fifteen dollars, two and a half billion stolen

According to The Straits Times, the attackers paid about fifteen dollars to put a special permission in place on a Binance hot wallet known as Binance 14. That wallet works like an online cash register for customer withdrawals, so it regularly holds huge piles of Ether, stablecoins and dozens of other tokens.

The setup transaction moved no money at all. It simply told Ethereum to let attacker-controlled software act for the wallet. About three and a half minutes later, the hackers pulled the trigger and moved roughly two point five billion dollars in a single transaction, which security firm Blockaid says was about forty percent of the total haul.

The feature that made it easy

The tool in question is EIP-7702, an Ethereum upgrade that went live in May 2025. Before it, a basic crypto wallet was closer to a current account where the owner signed off on every transaction. The upgrade added something like autopay, letting a wallet hand software the power to act for it and bundle many actions together.

That is great for everyday users who want smoother apps. For a hacker already inside, it meant emptying more than sixty tokens in one go instead of firing off a long series of separate transfers that could trip alarms. Hypernative's chief technology officer Dan Caspi put it plainly: a defender wants to slow the attacker down, and this feature helped the hackers move faster.

Why shutting things down did not help

Here is the part that stings. Because the permission lived on Ethereum itself, Binance halting withdrawals did not automatically cancel it. Deposits kept flowing into Binance 14, so the attackers could keep sweeping new funds. Elliptic later put the total taken through that permission at about three point six billion dollars, including eight hundred twenty three million pulled from another Binance account.

Binance says it has revoked the delegation, rebuilt the affected wallet infrastructure and tightened its signing and monitoring rules. A spokesperson also said user funds remain protected and the exchange has absorbed the financial impact. The company previously said the intruders got in through a fake job interview aimed at one of its engineers.

Insurers are now asking tougher questions

The fallout is spreading beyond one exchange. According to Reuters, insurers are preparing to probe crypto firms harder on security and on any exposure to Binance when policies come up for renewal. Reuters adds that no available crypto policy could cover a loss of this size.

The FBI has blamed a North Korea-linked group, and Pyongyang denies involvement. That matters for coverage, since Reuters notes that cyber policies placed at Lloyd's have generally required exclusions for state-backed attacks since 2023. Morningstar DBRS analyst Marcos Alvarez told Reuters that insurers may dispute claims when an attack is pinned on a state.

Still, nobody expects insurers to flee the sector. Marsh's Jacqueline Quintal told Reuters she did not anticipate material changes in capacity, pricing or coverage, only more questions from underwriters.

What it means for your coins

If you keep crypto on an exchange, this Binance hack is a reminder that your coins sit behind the same wallet tech as everyone else's. Holding assets in your own wallet has its own risks, but the lesson from this story is that clever shortcuts cut both ways. Features built to make life easier can make a breach far more damaging once someone gets in.

Markets are already jumpy. Bitcoin slipped under seventy six thousand dollars on Thursday during a wider tech rout, and sat near that level on Friday, according to CoinDesk. More details on the investigation are expected, so keep an eye on the crypto beat for updates.