Hackers moved $2.5 billion out of a Binance hot wallet in one transaction after a $15 authorization

The on-chain phase of the Binance theft was short. Blockchain security firm Blockaid found that the attackers paid about $15 in Ethereum fees to set up a delegation that gave their own software control of a Binance hot wallet. That step moved no tokens. About three and a half minutes later, roughly $2.5 billion, about 40% of the total, left the wallet in a single transaction. Rekt News has published its own account of the incident.

The $15 fee was the last step of a long operation. The attack began with social engineering. A Binance engineer took what he believed was a job interview, and Binance has described a recruiter message and a coding assignment as the entry points. Analysts cited by PBX Science note that the delegation only worked because the attackers had already compromised Binance's signing infrastructure. The root cause is therefore a key and signing compromise achieved through an employee. The Federal Bureau of Investigation (FBI) attributes the theft to TraderTraitor, a group linked to North Korea, according to Wikipedia's summary of official statements. North Korea has denied involvement.

Binance says the total loss is $6.3 billion, which The Washington Post called a record. The exchange said on November 2 that it had covered 95% of the stolen assets from its reserves and corporate treasury. Tether and Circle froze more than $2 billion of their own tokens taken in the theft. The blockchain analytics firm TRM said $2.4 billion was already "beyond any issuer's reach", and the stolen funds are being converted into ether.

On November 7, Binance confirmed that its chief financial officer (CFO), Kaiser Ng, is leaving and named Justin Yek as his successor, according to Bloomberg as relayed by BWE News. The sources do not connect the departure to the theft. The same day, CoinDesk reported that users in Spain, France and Poland had received notices to withdraw before fees begin, with accounts closing on December 31. Binance France told customers it will close all accounts after it failed to obtain authorization under the European Union's Markets in Crypto-Assets Regulation (MiCA). Deposits there are already blocked.