Binance experienced a $6.3 billion security incident Oct. 30 when attackers gained access to an internal wallet-signing service, moving funds outside standard withdrawal procedures across 10 blockchains.
Co-CEO Richard Teng confirmed the breach affected the exchange's hot wallet. The majority of customer assets are held in offline cold storage, with funds moved to hot wallets only when users request withdrawals.
On Ethereum specifically, attackers repeatedly drained the hot wallet as new deposits arrived, indicating a continuous exploit. Public blockchain records show fund movements during the incident, but they do not reveal the internal controls governing such transfers.
Binance chose to keep technical details confidential to prevent future attacks and did not respond to inquiries about wallet balances and safeguards. This contrasts with rivals like Coinbase, Gate, and Upbit, which have disclosed their cold-storage ratios following the breach.
CertiK analyst Jonathan Riss said wallet balances provide only a partial view of an exchange's exposure. The $6.3 billion figure represents cumulative value across all affected blockchains, but a single wallet balance does not fully capture exposure during an active exploit.
When attackers acquire valid signatures, their potential access depends on the specific limits the signing system imposes. Transaction limits enforced by the requesting application can be bypassed if that application is compromised, but limits enforced independently by the signing system itself may still restrict transfer volume, Riss said.
External comparison of internal signing architectures across exchanges is challenging. Public information on these systems is limited, and proof-of-reserves attestations show asset distribution, not how withdrawal authorizations function.
BitGo chief product officer Eugene Hahr declined to speculate on Binance's internal safeguards, saying Binance is best positioned to answer questions about its custody arrangements.
Fireblocks co-founder Idan Ofrat said exchanges typically maintain enough funds in hot wallets to cover a few days of expected withdrawals—often a low single-digit percentage of total assets under management. Many keep the bulk of customer assets in cold storage and use intermediate wallets that require manual approval before transfers to hot wallets are executed.
