Binance Hack: How a $15 Move Helped Hackers Steal $2.5 Billion
 |
| By Juan Villaverde Reviewed by: Dawn Pennington |
I told my Weiss Crypto Portfolio subscribers something yesterday about the Binance hack: The weak link wasn’t the technology. It was people.
Today, Bloomberg filled in the rest of the story. And one number jumps off the page.
$15.
That’s what the hackers reportedly paid in network fees to set up the move that let them take about $2.5 billion in a single transaction.
That’s 40% of the $6.3 billion they got away with.
It Started with a Fake Job Posting
Binance calls it a “sophisticated, multi-stage campaign.”
The first stage: An engineer got tricked into downloading malicious code.
That’s the human weak link I flagged.
Once inside, the hackers went after a “hot wallet,” the online cash register Binance uses to process customer withdrawals.
Then they used a shortcut.
Since May 2025, Ethereum (ETH, “B+”) has let a wallet give software permission to act for it.
Think of it like autopay for your wallet. You approve it once instead of signing every payment.
The hackers used a valid signature to give their own software that permission.
That step cost about $15 and moved no money.
Three and a half minutes later, they pulled the trigger and emptied the wallet.
Shutting the Door Didn’t Cancel the Autopay
Here’s the part that matters.
Even after Binance spotted the breach and shut off withdrawals, the permission still lived on Ethereum.
The hackers could keep going. And they did.
Deposits kept landing in that hot wallet. The hackers swept it four more times. Using the same permission, they took about $3.6 billion in all, according to blockchain analysts at Elliptic.
Related story: History’s Biggest Heist Just Hit Crypto
It’s like closing your bank’s website and assuming your autopay stopped. It didn’t. You have to cancel the autopay itself.
Binance did that around 8:10 p.m. Eastern — some four hours after the attack started.
That’s the lesson. Features built to make crypto easier can also make a breach far worse once someone’s inside.
The Same Shortcut Can Still Hit Your Wallet
This isn’t just an exchange problem.
Scammers started using this feature on everyday wallets almost as soon as it launched. Within weeks, trading firm Wintermute found most of these permissions pointed to copy-and-paste code built to sweep wallets clean.
The trick is the same one that hit Binance. Get you to sign one harmless-looking approval. Then take everything later.
Three quick moves can protect you:
- Never sign what you don’t understand. Be extra careful with any pop-up asking you to “upgrade” or “activate” your account. That’s often this permission in disguise.
- Clean up old permissions. Check what your wallet has approved, and revoke anything you don’t use. Beth Canova walks you through exactly how.
- Keep long-term coins offline. A hardware wallet bought straight from the maker keeps your keys away from the internet.
Related story: Trezor Data Breach Raises Serious Security Concerns
What Hasn’t Changed
The $6.3 billion is still only about 4% of the roughly $145 billion Binance held.
The exchange says it has put back about 95% of what was taken and has taken the loss itself.
It also says it has revoked the permission, rebuilt the wallet and tightened its controls.
The FBI blames North Korea, which denies it.
So my answer to the question that matters is the same as yesterday’s. Can the exchange make its users whole? So far, yes.
And no, this doesn’t change Bitcoin’s (BTC, “B+”) trend. The pullback began Sept. 21, well before anyone touched Binance’s wallets.
What matters now is where Bitcoin goes next.
In fact, I’m watching one key price level that could confirm Bitcoin has put in its next low. I’ve also mapped out where I believe it could head from there.
I shared that analysis with my Weiss Crypto Portfolio members earlier this week. You can get access to those insights here.
Best,
Juan
