Largest Crypto Hack: Hackers Paid ₹1,425 to Steal ₹34,000 Crore: How Hackers Emptied Binance With One Fake Job Offer

Hackers who drained an estimated ₹59,850 crore (about $6.3 billion) from Binance, the world's largest cryptocurrency exchange, paid roughly ₹1,425 in network fees to unlock the biggest part of their haul. Blockchain security firm Blockaid traced a single transaction that moved about ₹23,750 crore out of one Binance wallet within minutes. The FBI has blamed the 29 October attack on North Korea, making it the largest cryptocurrency theft ever recorded.

A Job Offer That Opened the Vault

According to the timeline Binance released on Tuesday, the breach did not start with a sophisticated assault on the blockchain. It started with a fake job posting.

The attackers used phony recruitment listings to persuade a Binance engineer to download malicious code. Binance described what followed as a multi-stage campaign involving social engineering, compromised devices and AI techniques. From that first foothold, the hackers worked their way to the systems that approve the exchange's transactions.

Gaining that access let them sign transactions that looked entirely genuine to the network.

The ₹1,425 Trick

The key tool was EIP-7702, an Ethereum upgrade introduced in May 2025. It allows a wallet to hand software the authority to act on its behalf, and was designed to make crypto wallets easier to use.

At about 8:20 pm UTC on 29 October, the hackers sent instructions carrying a valid signature from a Binance hot wallet labelled "Binance 14". The transaction moved no money and cost about $15, or roughly ₹1,425. Its only job was to authorise the attackers' own code to control the wallet.

About three and a half minutes later, that code struck. In a single transaction it moved about $2.5 billion, including 167,464 Ether and more than 60 other tokens, led by $1.6 billion in Tether's USDT stablecoin. That one transfer accounted for about 40 per cent of everything stolen.

Within the next 12 minutes, ten more Binance hot wallets across several blockchains sent funds to the same address.

Why Binance Could Not Shut the Door

The permission sat on the Ethereum blockchain, not inside Binance's own systems. Pausing withdrawals and switching off hot-wallet services did nothing to cancel it.

Deposits kept arriving in Binance 14, and the hackers kept sweeping them. Blockchain intelligence firm Elliptic found that the same permission gave the attackers about $3.6 billion, close to ₹34,200 crore. That figure includes the first transfer, $823 million taken from another Binance account and four further sweeps of Binance 14.

Dan Caspi of security firm Hypernative said EIP-7702 helped the hackers move faster and keep control of the wallet "even after Binance detected the breach".

North Korea in the Frame

The FBI has attributed the theft to North Korea, linking it to TraderTraitor, a hacking operation tied to the Lazarus Group. Lazarus has been behind a string of record crypto heists, including the $1.5 billion Bybit theft in 2025. Pyongyang denies involvement.

The FBI has published Ethereum, Bitcoin and Solana wallet addresses linked to the attack and asked the public for information. The US Secret Service says it is working to track, freeze and recover the funds.

How Much Has Been Recovered

Binance says it froze about $2.85 billion, or roughly ₹27,000 crore, with help from stablecoin issuers such as Tether and Circle. Some analysts put the figure near $3 billion. The rest is spread across thousands of wallets as the hackers try to launder it.

Binance confirmed that EIP-7702 "played a significant role" in the hack. It says it has revoked the compromised permission, rebuilt the affected wallet systems and tightened controls on similar transactions. The exchange says customer funds are protected and that it is covering the losses from its SAFU emergency fund, an insurance fund and its own treasury.

What It Means for Crypto Users

For Indian investors, the exchange's assurance that user balances remain intact will offer some relief. The bigger warning is how the attack began. A single employee tricked by a fake job offer gave hackers the opening to one of the world's biggest stores of digital money.

Fake recruitment scams aimed at tech professionals are already common in India. The Binance breach shows how much damage one convincing offer letter can do once it reaches the wrong inbox.

(Rupee figures are approximate, converted at about ₹95 to the US dollar.)