Summary Points
- Attackers transferred about $6.34 billion from Binance wallets using malicious Ethereum smart-account authorizations.
- They gained signing access by compromising developers through a tampered software tool and a fake job interview.
- The EIP-7702 “sweeper” bypassed normal withdrawal controls and kept moving funds for nearly four hours; Binance says it froze or recovered about $2.85 billion.
- Crypto firms need real-time authorization monitoring, developer protections, and a tested kill switch to revoke access and halt transfers fast.
Binance Breach Highlights Control Weaknesses at Crypto Orgs
A hidden authorization kept moving funds
On Oct. 29, attackers moved about $6.34 billion in cryptocurrency from at least 11 Binance wallets to addresses they controlled, according to the incident report. They used compromised developer systems to gain signing privileges and install malicious code on a wallet.
The code relied on an Ethereum feature called EIP-7702. It let the attackers create a standing authorization that could move funds outside Binance’s usual withdrawal process. As a result, suspending withdrawals did not revoke that permission.
Binance detected suspicious activity within minutes and took countermeasures. However, the authorization continued to work for about four hours. The company said it froze or recovered about $2.85 billion in attempted stolen assets. The breach shows why alerts alone cannot stop a fast-moving attack: firms also need a tested way to cancel risky permissions and pause transactions.
People and systems both need protection
The attackers reportedly compromised three developers’ systems. They used a tainted software download and a fake job assignment to gain access. That tactic points to a wider risk: employees, software suppliers and cloud tools can all connect attackers to systems that control funds.
Crypto firms can reduce that risk with stronger developer security, limits on transaction size and destination, and monitoring for bursts of unusual activity. They also need a pretested “kill switch” that can pause signing, block wallet refills and revoke access quickly.
These steps require planning and regular practice. Still, they could help firms contain attacks within seconds rather than hours. Faster responses matter because blockchain transfers can be difficult to reverse. As more people and businesses use digital assets, reliable safeguards will help make that technology more practical and trustworthy.
Expand Your Tech Knowledge
Dive deeper into the world of Cryptocurrency and its impact on global finance.
Access comprehensive resources on technology by visiting Wikipedia.
CyberRisk-V1
