Binance co-CEO Richard Teng said the attackers behind the roughly $6.3 billion hack disclosed on October 30 built self-destruct mechanisms into their operation, erasing their tools and traces as the attack ran, a measure he said has made the incident significantly harder to trace.

The October 30 update also laid out how the attackers gained control of a hot wallet, why the investigation has widened beyond its initial lead, and what Binance is doing to restore services, audit its systems, and demonstrate its reserves.

Teng confirmed that multiple people took part in the attack. Investigators initially suspected a compromised laptop as the entry point, but the team later identified other entry points into Binance's systems. As a result, the scope of the review has grown, and the Co-CEO said the widening investigation has become more complex.

Self-Destruct Tools and Wiped Linkage Data

According to the update, the self-destruct mechanisms erased tools and traces while the attack was underway. The attackers also removed linkage data during execution, which limits how easily investigators can connect the malicious activity. The team continues to work through the remaining data as the inquiry proceeds. That deletion carries weight because blockchain tracing generally depends on precisely this kind of linkage data to cluster addresses and follow stolen funds — meaning the outside intelligence firms now assisting Binance are working from a deliberately thinned record.

How the Attackers Took Control

Teng said the attackers used EIP-7702, an Ethereum standard that allows ordinary wallet addresses to take on smart-contract functionality, to gain on-chain execution authority over a hot wallet. That step bypassed the exchange's normal approval controls, meaning the hot wallet moved funds without the usual internal sign-off.

Hot wallets stay connected to the internet so exchanges can process day-to-day withdrawals, which makes them a natural focal point in exchange security. EIP-7702 is itself recent: it went live with Ethereum's Pectra upgrade in May 2025 as part of the network's push to bring smart-account capabilities to standard wallets.

The incident resulted in a loss of roughly $6.3 billion, and the concealment measures have complicated efforts to reconstruct the attackers' path through Binance's systems, according to the update.

Withdrawals Paused While Systems Are Rebuilt

Binance has paused withdrawals while it rebuilds and tests its systems, Teng said. The service will stay offline until it passes security and functional testing, which means users cannot withdraw funds from the exchange in the meantime.

The exchange is targeting restoration within 40 hours, a timeline that falls ahead of the Sunday deadline mentioned in the update.

As part of the wider recovery effort, Binance has also started a full security audit. The review covers all endpoints, cloud infrastructure, key management protocols, and cryptographic signing procedures — the controls that govern how transaction authority is granted and executed.

Proof of Reserves Report Due by Monday

Proof of reserves is another priority. Binance is finalizing the purchase of its remaining assets, after which it plans to release an initial overview of reserves. A full report is expected by Monday, and it is meant to show asset backing and liquidity.

Reports of this kind became widespread industry practice after the 2022 collapse of FTX, when exchanges came under pressure to show users that customer assets were genuinely backed.

Cooperation With Authorities and Industry Partners

Teng added that Binance is working with outside partners to trace and recover the stolen funds. These include law enforcement agencies, blockchain intelligence firms, token issuers, and other exchanges. The exchange also plans to pursue legal accountability for the attackers and will coordinate with these groups as the investigation continues.

Source: Blockonomi