Hackers spent just $15 to steal billions from Binance
What's the story
The recent hack of cryptocurrency exchange Binance, which resulted in a loss of $6.3 billion, was executed using a clever tactic. The hackers utilized EIP-7702, an Ethereum upgrade that allows software to be given permission to transfer funds on behalf of an account. This feature was originally intended to simplify crypto wallet usage but was weaponized by the hackers for their own gain.
Exploitation details
Attack was part of a 'sophisticated, multi-stage campaign'
The hackers paid a mere $15 in network fees to activate the permission granted by EIP-7702.
They then used it to steal some $2.5 billion in one transaction, accounting for 40% of the total amount stolen, according to security firm Blockaid.
The attack was part of a "sophisticated, multi-stage campaign" that involved social engineering, compromised devices, and AI techniques, Binance said on Tuesday.
Targeted wallet
Targeting the hot wallet
The hackers specifically targeted a "hot wallet" called Binance 14, which is used by the exchange to process customer withdrawals.
This wallet holds large amounts of Ether, stablecoins, and dozens of other digital tokens as Binance is the world's largest crypto exchange.
Normally, moving such a large amount of different assets would require multiple transfers, but EIP-7702 provided a shortcut for the hackers.
Trap activation
How the hackers executed the attack
At around 8:20pm UTC on October 29, the hackers sent instructions using a valid signature from the Binance 14 wallet.
This was to allow attacker-controlled code to act on the account's behalf, Blockaid said.
Three and a half minutes later, they activated their trap and under the new permissions given by EIP-7702, their software transferred some $2.5 billion in one go.
Total theft
Hackers stole $3.6 billion in total using the same permission
The hackers used the same permission to steal some $3.6 billion in total, including the first $2.5 billion haul.
This included 167,464 Ether and over 60 other tokens, led by $1.6 billion in Tether's USDT stablecoin.
Despite Binance disabling withdrawals or shutting down its hot-wallet services, the permission remained active on Ethereum, allowing further transfers by the hackers.
Risk mitigation
Binance takes steps to mitigate risk
A Binance spokesperson confirmed that EIP-7702 "played a significant role" in the hack and said they have taken steps to mitigate this risk.
These include revoking the affected delegation, rebuilding the affected wallet infrastructure, and updating their signing and monitoring controls.
They also implemented stricter policies around delegation-type transactions, enhanced behavioral monitoring, additional transaction-level controls, and emergency revocation procedures.