Abstract:
The hackers who stole $6.3 billion from Binance last week found a way to transfer 40% of the stolen cryptocurrency in one fell swoop, reducing the chance of being detected during the operation. The price they paid was only $15. Examining transaction records on the Ethereum blockchain shows how a group of thieves turned a feature originally designed to make cryptocurrency wallets more convenient into an attack tool. This feature allows account authorization software to transfer funds on your behalf without having to obtain separate authorization for each transfer.
Security firm Blockaid said the hackers paid about $15 in network fees to establish the authorization and then used it to transfer about $2.5 billion in a single transaction, equivalent to 40% of the total amount stolen.
Binance released a detailed timeline of events on Tuesday, stating that the intruders used fake job openings to trick an engineer into downloading malicious code. Binance said it was a "sophisticated, multi-stage attack" that combined social engineering, compromised devices and AI technology.
According to records from the Etherscan analysis platform, after the successful intrusion, the hackers targeted a "hot wallet" named "Binance 14", which Binance used to process customer withdrawals. This wallet is a bit like an online cash register; since Binance is the world's largest cryptocurrency exchange, it often holds large amounts of ether, stablecoins, and dozens of other cryptocurrencies.
Shortcut
Transferring so many different assets usually requires a series of independent transfers, each of which takes time and creates an additional opportunity for security systems to notice anomalies.
But an Ethereum software upgrade called EIP-7702 provides a shortcut for hackers.
Before this upgrade is implemented in May 2025, a basic cryptocurrency wallet will be more like a checking account, and in principle every transaction will need to be signed and authorized by the holder. After the upgrade, a function similar to "automatic deduction" has been added, allowing the wallet to authorize the software to act on its behalf and package multiple operations together for execution.
Blockaid stated that at approximately 20:20 UTC on October 29, the hacker used a valid signature from the Binance 14 wallet to send an instruction requesting the Ethereum network to allow code controlled by the attacker to perform operations on behalf of the account. This is when the hacker pays typical network processing fees to establish this authorization.
The transaction itself does not move any funds, it simply tells Ethereum to allow the hacker's software to act on behalf of this wallet.
Blockchain research firm Tibane Labs said in a report that this program only does one thing: when its owner requests it, it empties the wallet and transfers the assets to the address specified by the owner.
Three and a half minutes later, the hacker activated the trap. Blockaid said that under the new authorization, the attacker's software transferred approximately $2.5 billion in a single transaction. The stolen assets include 167,464 Ethereum coins and more than 60 other tokens, of which Tether’s stablecoin USDT is worth up to US$1.6 billion
Comments