Bloomberg reports that hackers tied to the Binance security breach moved $2.5 billion in cryptocurrency in a single transaction while paying approximately $15 in network fees. According to the report, the attackers used functionality associated with Ethereum's EIP-7702 upgrade to execute the transfer — an incident that raises questions about wallet security and the risks tied to advanced transaction capabilities.

The reported transaction highlights how large amounts of digital assets can move across blockchain networks at relatively low cost. The gap between the value of the transfer and its fee is particularly striking, though blockchain transaction fees are generally determined by network resource usage rather than by the dollar value of the assets being moved. As a result, a multibillion-dollar transfer does not necessarily require a proportionally large fee.

Bloomberg's report does not establish that the EIP-7702 upgrade itself contained a security vulnerability. It also does not explain whether the attackers exploited compromised wallet permissions, stolen credentials or another weakness.

Cointelegraph highlighted the report in a post on X:

NEW: Binance hackers paid just $15 in network fees to drain $2.5 billion in a single transaction via a feature from Ethereum's EIP-7702 upgrade, per Bloomberg. pic.twitter.com/RrqgoFKLp7

— Cointelegraph (@Cointelegraph) November 6, 2026

How Ethereum's EIP-7702 Upgrade Works

The report has drawn attention to a relatively new Ethereum feature. EIP-7702, first proposed by Ethereum co-founder Vitalik Buterin in 2024, was introduced as part of Ethereum's Pectra upgrade — which activated on the network's mainnet in May 2025 — to expand the capabilities of externally owned accounts. Traditionally, these accounts are controlled through private keys and have more limited functionality than smart contract wallets, which are accounts whose logic is governed by deployed code.

Under the upgrade, eligible accounts can delegate certain functionality to smart contract code by providing a signed authorization, allowing the contract logic to run in the same transaction rather than through separate approval and execution steps. This enables features such as transaction batching, sponsored fees and more flexible wallet operations — capabilities designed to improve how users interact with Ethereum applications, building on earlier account-abstraction efforts such as ERC-4337.

Advanced wallet permissions, however, must be managed carefully. If an attacker gains control of an account or persuades a user to authorize malicious functionality, the consequences can be serious. The presence of EIP-7702 in a transaction does not, by itself, demonstrate that the Ethereum protocol was compromised, and determining the exact cause of the reported transfer would require a detailed technical investigation.

What the Reported Hack Means for Crypto Security

The transaction underscores the importance of protecting wallet authorization mechanisms. Public blockchains are designed to execute valid transactions regardless of who initiates them, meaning a transfer can be processed on-chain even when the person behind it has obtained access through unauthorized means. That makes private key protection, transaction approval controls and monitoring systems essential for cryptocurrency custodians.

The incident also illustrates how quickly large amounts of digital assets can be transferred once an attacker gains sufficient control — a pattern seen in earlier large-scale breaches, including the roughly $1.5 billion stolen from the exchange Bybit in February 2025. For exchanges, strong internal safeguards can be just as important as the security of the underlying blockchain. These may include distributed authorization, withdrawal restrictions and systems designed to detect unusual activity.

Further technical disclosures — from Binance, on-chain analysts or Ethereum developers — would be needed to determine exactly how the reported transfer occurred. For now, Bloomberg's account highlights the scale and low transaction cost of the alleged movement of funds, while leaving important questions about the attack mechanism unanswered.