Binance Co-CEO Richard Teng revealed details about the roughly $6.3 billion hack disclosed on October 30, explaining that attackers deployed self-destruct mechanisms to erase their tools and traces from the system.
How the Attack Unfolded
According to Teng, multiple people were involved in the coordinated attack. Initial investigations suspected a compromised laptop, but the team later identified additional entry points, expanding the scope of the security review and making the hack harder to trace.
The attackers gained control by using EIP-7702 to obtain on-chain execution authority over a hot wallet, bypassing Binance's normal approval controls. The hot wallet then transferred funds without the usual internal authorization. During execution, the attackers also removed linkage data, further limiting investigators' ability to track the activity.
Recovery and Investigation Efforts
Binance has paused withdrawals to rebuild and test its systems. The exchange is targeting restoration within 40 hours, pending completion of security and functional testing.
The company has initiated a full security audit covering all endpoints, cloud infrastructure, key management protocols, and cryptographic signing procedures. A proof of reserves report is expected by Monday to demonstrate asset backing and liquidity.
Binance is collaborating with law enforcement agencies, blockchain intelligence firms, token issuers, and other exchanges to trace and recover the stolen funds. The exchange plans to pursue legal accountability for the attackers as the investigation continues.
