Binance hackers drain 2.5 billion dollars in single transaction using new feature

Hackers executed the largest cryptocurrency theft in history, draining billions from Binance by weaponising a newly implemented Ethereum feature that bypassed traditional security checks. The attackers weaponised an upgrade designed to simplify transactions, executing a single transfer that emptied a massive portion of the exchange's hot wallet reserves in moments. As market analysts examine the wider fallout, digital asset prices have plummeted across global exchanges, and regulatory pressures have intensified following political shifts in Washington.

The security breach unfolded when infiltrators targeted a hot wallet utilized by the exchange to process customer withdrawals, according to records on Etherscan cited by Moneyweb. Moving thousands of diverse assets typically requires multiple individual transfers, each offering security monitoring systems an opportunity to detect anomalous behavior. Instead, the perpetrators utilized an Ethereum software upgrade implemented in May 2025 known as EIP-7702, which introduced auto-pay functionality and allowed accounts to grant software permission to act on their behalf.

Media additions

Security firm Blockaid reported that the hackers paid a small network processing fee to put the delegation in place, and subsequently triggered the trap three and a half minutes later. The single transaction yielded roughly $2.5 billion, encompassing Ether and dozens of alternative tokens led by Tether stablecoins. Blockchain intelligence firm Elliptic noted that subsequent sweeps raised the total taken from that specific hot wallet even higher. Hypernative co-founder and chief technology officer Dan Caspi stated that the upgrade helped the hackers move faster and maintain control of the wallet even after the breach was detected.

Further complicating recovery efforts, Arkham intelligence data highlighted by TradingView revealed that the opening move of the multi-billion-dollar theft involved draining hundreds of millions in XRP across multiple accounts into a newly created ledger address. While issuers like Tether and Circle possess the capability to freeze stablecoins—with TRM Labs noting billions in frozen tokens—XRP functions as a native coin where neither creators nor external parties can claw back or freeze the assets. Consequently, a massive hoard of digital coins remains untouched in a single address.

The timing of the exploit compounded distress across the wider financial ecosystem, coinciding with a sharp downturn in technology equities and risk assets. According to Itiger, benchmark tokens plummeted significantly while major mining and data center operators suffered double-digit percentage drops. Concurrently, political developments in the United States added regulatory headwinds, with market observers noting that recent legislative shifts threaten prospects for long-awaited industry oversight frameworks.

Binance representatives confirmed that the delegation feature played a central role in the incident and outlined remedial measures. The exchange stated that it revoked the affected delegations, rebuilt its hot wallet infrastructure, and updated both signing and monitoring controls to address authorisation risks. The FBI has attributed the record-breaking cyberattack to North Korea, though Pyongyang has denied involvement.

For market participants following the aftermath, attention remains fixed on the unfreezeable wallet holding the stolen XRP and the broader trajectory of platform withdrawals.