Binance Co-CEO Says Attackers Used Self-Destruct Tools to Hide $6.3B Hack Traces

TLDR:

• Teng said multiple people took part in the roughly $6.3 billion Binance hack disclosed on October 30.
• Self-destruct mechanisms erased the attackers’ tools and traces, making the hack harder to trace. 
• Attackers used EIP-7702 to gain on-chain authority over a hot wallet, bypassing approval controls.
• Binance targets withdrawal restoration within 40 hours and a proof of reserves report by Monday.

Binance Co-CEO Richard Teng said attackers used self-destruct mechanisms to erase their tools and traces. The update on October 30 covers the roughly $6.3 billion hack.

Teng confirmed that multiple people were involved. Investigators first suspected a compromised laptop but later found other entry points.

As a result, tracing the attack has become harder. Binance has paused withdrawals to rebuild its systems and is working with law enforcement to trace the stolen funds.

Teng Details How the Attackers Operated

In the post, he said multiple people were involved in the attack. According to Teng, the attackers built self-destruct mechanisms into their operation. These mechanisms erased tools and traces as the attack ran. Teng said this made the hack harder to trace.

Teng also addressed the early findings. He said investigators initially suspected a compromised laptop. However, the team later found other entry points. The scope of the review has grown as a result. The Binance Co-CEO said this made the investigation more complex.

The Binance Co-CEO then explained how the attackers gained control. He said they used EIP-7702 to gain on-chain execution authority over a hot wallet.

According to Teng, this step bypassed Binance’s normal approval controls. In other words, the hot wallet moved funds without the usual internal sign-off.

The attack resulted in a loss of roughly $6.3 billion. The update also noted that the attackers removed linkage data during execution.

This limits how easily investigators can connect the activity. Meanwhile, the team continues to work through the remaining data.

Binance Rebuilds Withdrawals and Works With Authorities

Teng said Binance paused withdrawals to rebuild and test its systems. The service will stay offline until it passes security and functional testing. Until then, users cannot withdraw funds from the exchange.

Meanwhile, the exchange is targeting restoration within 40 hours. That falls ahead of the Sunday deadline mentioned in the update.

The company has also started a full security audit. The review covers all endpoints, cloud infrastructure, key management protocols, and cryptographic signing procedures. These checks are part of the wider recovery effort.

Proof of reserves is another priority. Binance is finalizing the purchase of its remaining assets. After that, it plans to release an initial overview of reserves. A full report is expected by Monday. The report is meant to show asset backing and liquidity.

Teng added that Binance is working with outside partners. These include law enforcement agencies, blockchain intelligence firms, token issuers, and other exchanges. Together, they aim to trace and recover the stolen funds.

The exchange also plans to pursue legal accountability for the attackers. Binance will coordinate with these groups as the investigation continues.

The post Binance Co-CEO Says Attackers Used Self-Destruct Tools to Hide $6.3B Hack Traces appeared first on Blockonomi.