Unanswered Security Concerns after Binance’s $6.3 Billion Hot Wallet Breach

Binance co-CEO Richard Teng revealed on October 30 that the breach compromised the exchange’s own hot wallet. While most customer assets were stored offline in cold wallets, transfers to hot wallets occurred only when users requested withdrawals.

Wallet balances alone do not fully explain an exchange’s vulnerability to attacks. Public blockchain data can track funds movement but cannot expose the internal control mechanisms overseeing these transfers, said CertiK analyst Jonathan Riss.

Binance’s initial report on Tuesday stated that attackers exploited an internal wallet-signing service to move funds bypassing the standard withdrawal process. The company withheld some technical details to prevent further exploitation.

Binance did not provide Cointelegraph with responses regarding wallet balances or security measures.

Other exchanges such as Coinbase, Gate, and Upbit have publicly shared their cold storage ratios following the breach.

Riss explained the $6.3 billion figure represents the total value of affected assets spanning 10 blockchains. On Ethereum, attackers repeatedly emptied a hot wallet as fresh deposits arrived.

An attacker’s potential access depends on what the signing system permits over time when valid signatures are compromised. Hence, a wallet’s balance at a single point doesn’t reveal full exposure.

Transaction limits enforced by the application requesting signature approval can be bypassed if compromised, though limits applied by the signing system itself might still restrict transfers, Riss noted.

Comparing Binance’s setup to other exchanges is almost impossible externally. Public details about internal signing systems are limited industry-wide. Proof-of-reserves show asset locations, not the internal authorization processes for withdrawals.

Eugene Hahr, BitGo’s chief product officer, refrained from speculating on Binance’s internal security procedures.

He suggested Binance is best positioned to disclose how their custody arrangements break down.

Idan Ofrat, co-founder and COO of Fireblocks, indicated exchanges typically maintain hot wallets with just enough funds for a few days’ withdrawal volume, often a low single-digit percentage of overall assets.

Exchanges commonly store the majority of client funds in cold storage, with some employing intermediate wallets requiring manual approval to move funds to hot wallets.

Alex Tobol, CTO of Telegram-based crypto wallet Walt, said that holding billions in hot wallets isn’t unusual for a platform the size of Binance.

Hot wallets usually process withdrawals automatically, but replenishing them from cold wallets should involve treasury decisions and manual approvals.

Hahr emphasized that controls implemented before transaction signing—such as limits, pre-approved withdrawal addresses, and extra authorization steps—can help mitigate losses when systems are compromised.

This incident underlines the crucial importance of transparent and robust internal controls over hot wallets, as external data alone cannot fully assess an exchange’s security posture. Enhancing these measures is vital for safeguarding user assets.

Understanding and strengthening hot wallet management is essential for protecting customer funds and maintaining trust in crypto exchanges. This case highlights the complexities and challenges faced in securing large-scale digital asset platforms.

Strong internal safeguards and transparency about custody structures could limit damage from future breaches and enhance industry security standards.