Binance is facing intensified scrutiny over its hot wallet safeguards following a $6.3 billion security incident that exposed significant portions of its liquid assets to attackers. The breach, which affected the exchange’s own hot wallets, has left critical questions unanswered regarding how the platform managed internal controls and limited the scope of the theft.
Attack vector and scale
In an initial report released on Tuesday, Binance stated that attackers gained access to an internal wallet-signing service, allowing them to move funds outside the exchange’s normal withdrawal process. The company noted that some technical details would remain confidential to prevent further exploitation of its systems.
CertiK analyst Jonathan Riss told Cointelegraph that the $6.3 billion figure represented the cumulative value of assets affected across 10 different blockchains. On Ethereum, blockchain records showed attackers repeatedly draining a hot wallet as new deposits arrived, highlighting the dynamic nature of the exploit.
Riss noted that while public blockchain records can track the movement of funds, they cannot establish the internal controls governing those transfers. This limitation has made it difficult for external observers to fully assess the breakdown in Binance’s security architecture.
Executive statements on custody
Binance co-CEO Richard Teng addressed the incident on Oct. 30, confirming that the attack targeted the exchange’s own hot wallet. Teng stated that most customer assets were held in offline cold storage and were only moved to hot wallets when users requested withdrawals.
Despite these assurances, the exchange did not respond to Cointelegraph’s specific questions about its current wallet balances and the specific safeguards in place at the time of the breach.
Industry response and expert views
The incident has prompted rival exchanges, including Coinbase, Gate and Upbit, to publicly disclose their cold-storage ratios in an effort to reassure users about the security of their assets.
Industry experts offered mixed perspectives on the scale of the funds involved. Idan Ofrat, co-founder and chief product officer at Fireblocks, stated that exchanges typically keep enough funds in hot wallets to cover a few days of expected withdrawals, often representing a low single-digit percentage of assets under management.
However, Alex Tobol, chief technology officer at Telegram-based crypto wallet Walt, argued that holding billions of dollars in hot wallets is not inherently unusual for an exchange of Binance’s size given its trading volume.
Eugene Hahr, chief product officer at BitGo, declined to speculate on Binance’s specific internal safeguards. He stated that the breakdown of custody arrangements is a question Binance is best placed to answer, emphasizing the need for transparency from the affected platform.
