The hackers behind last week’s $6.3 billion Binance theft exploited a feature from Ethereum’s EIP-7702 upgrade to drain $2.5 billion, or about 40% of the haul, in a single transaction for $15 in network fees, Bloomberg reported. The authorization mechanism allowed the attackers to give their own smart contract partial control over a Binance hot wallet onchain, letting them bypass the exchange’s withdrawal pause until engineers built a custom fix to revoke access across its multi-party computation setup.

In an earlier incident report, Binance traced the Oct 29 breach to a months-long campaign that began when a wallet engineer downloaded a tampered Homebrew installer in June, followed in September by a second engineer downloading a malware-laced coding assignment during a fake job interview on his work computer. The attackers then used an internal AI tool on the infected laptop to compromise two wallet engineers and obtain deployment credentials for the exchange’s transaction-signing service. While the FBI attributed the heist to North Korea’s TraderTraitor group, Kim Yo Jong, sister of North Korean leader Kim Jong Un, rejected the claim as “absurd rhetoric” and a “grave political provocation.” Blockchain analytics firm Chainalysis said some of the stolen funds are now moving through Chinese money laundering networks as attackers route assets across 11 blockchains and roughly 12,000 wallets, while about $2.85 billion to $3 billion of the haul, mostly in USDT and USDC, has been frozen or intercepted.