Binance hot wallet exploit shows permission flaw in Ethereum withdrawal operations

Traders Union
All News
Crypto
Binance wallet exploit shows flaw

Highlights

Attackers exploited Binance's Ethereum hot wallet by tricking an engineer into downloading malicious code and granting software ongoing transaction permission with one valid signature.
Ethereum's wallet permission feature since May 2025 allowed attackers to reuse the same authorization, letting them repeatedly empty the wallet even after Binance detected the breach.
Elliptic estimates hackers stole about $3.6 billion by sweeping the compromised hot wallet multiple times, highlighting significant operational risks in always-online exchange wallets and standing permissions.

Exploit sequence and wallet permission mechanics

As reported by Weiss Ratings, Binance describes the breach as a "sophisticated, multi-stage campaign" that begins when an engineer is tricked into downloading malicious code. After gaining access, the attackers target a hot wallet, the online wallet Binance uses to process customer withdrawals.

The account explains that since May 2025, Ethereum lets a wallet grant software permission to act on its behalf without requiring a new signature for every transfer. The attackers allegedly use a valid signature to give their own software that permission, in a step that costs about $15 and initially moves no money.

Roughly three and a half minutes later, the attackers empty the wallet. The sequence suggests the core weakness is not Ethereum's underlying code, but the combination of compromised access and a standing authorization that can be reused once it is in place.

Ongoing exposure and broader exchange risk

Even after Binance detects the breach and turns off withdrawals, the permission remains active on Ethereum, according to the source text. That means the attackers can continue to use the same authorization after the initial theft if additional assets reach the compromised wallet.

The text says deposits keep landing in the hot wallet and the hackers sweep it four more times. Blockchain analysts at Elliptic estimate the attackers take about $3.6 billion in total, underscoring the operational risk for exchanges that rely on always-online wallets and automated permissions for customer fund flows.

Cohere’s planned acquisition of AI cybersecurity startup AISLE is aimed at strengthening automated vulnerability detection as it expands in Europe alongside its tie-up with Aleph Alpha. Our publication previously noted that AISLE’s AI has already identified hundreds of software bugs, including multiple OpenSSL vulnerabilities, highlighting how AI-driven security tools are becoming central to defending complex digital systems.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.