Binance $6.3B Hack Sparks Scrutiny of Hot Wallet Security Controls

Binance’s recent $6.3 billion security incident has shifted attention from headline loss figures to a more technical question: what exactly did the exchange’s wallet architecture allow attackers to do, and how much of the damage depended on the internal controls around its hot wallets.
In comments dated Oct. 30, Binance co-CEO Richard Teng said the attack targeted the exchange’s own hot wallet. He described a custody structure in which most customer assets are kept offline in cold storage and only moved into hot wallets to process withdrawals when users request them. But analysts caution that public blockchain data cannot fully answer how securely those withdrawals were authorized and limited once an attacker gained access.
Key takeaways

Binance said attackers affected its own hot wallet, while most customer funds are normally held in offline cold storage and topped up for withdrawals.
Blockchain transaction data can show what moved, but it cannot confirm the internal signing and approval controls that governed those transfers.
CertiK analyst Jonathan Riss said the potential damage depends on what the signature system allows over time, not just wallet balances at a single moment.
Fireblocks and other security leaders said exchanges often keep hot-wallet liquidity for expected withdrawals, typically a low single-digit share, though the exact design varies.
Binance’s initial incident report indicated attackers gained access to an internal wallet-signing service, but the exchange said some technical details would remain confidential.

What Binance says happened—and what remains opaque
According to Teng’s Oct. 30 remarks, the compromise impacted Binance’s own hot wallet rather than the bulk of assets stored offline. The practical implication of that distinction is significant for investors and users: if cold storage remained intact, the incident may largely reflect the mechanics of how hot wallets were populated and how withdrawals were authorized during the attack window.
Binance’s initial incident report (published Tuesday) provided a further clue. It said attackers accessed an internal wallet-signing service that enabled funds to move outside the exchange’s normal withdrawal process. The exchange also indicated it would withhold some technical specifics, citing the risk that additional disclosure could enable further attacks.
Binance did not answer follow-up questions from Cointelegraph regarding wallet balances and safeguards, leaving a major gap: how the signing environment was structured to prevent or slow down unauthorized transfers, and whether multiple layers of authorization were in place.
Why blockchain “proof” can’t settle the wallet-control debate
Even with a widely reported total figure of $6.3 billion, analysts say the number is not enough to understand exposure. CertiK analyst Jonathan Riss explained that the figure refers to the cumulative value of assets affected across 10 blockchains. On Ethereum specifically, he said attackers repeatedly drained a hot wallet as new deposits arrived, suggesting a dynamic process rather than a single one-time withdrawal.
Riss emphasized that the balance shown on-chain at a point in time is only part of the story. If an attacker obtains valid signatures, their ability to drain funds depends on the wallet-signing architecture—especially what signing permissions and time-based limits exist.
He also highlighted a control problem that matters whenever multiple systems interact. If transaction limits are enforced only by the application that requests signatures, an attacker who compromises that application may be able to circumvent those checks. In contrast, limits enforced directly by the signing system could still restrict withdrawals even after an attacker gains access to upstream software.
From the outside, he said, it’s difficult to compare exchanges fairly. Public information about internal signing architecture is limited across the industry. Proof-of-reserves and reserve attestations may indicate where assets sit, but they do not necessarily prove how withdrawals were authorized or what restrictions applied during a compromise. BitGo chief product officer Eugene Hahr similarly declined to speculate about Binance’s internal safeguards, saying the breakdown of custody arrangements is a question Binance is best positioned to answer.
How much liquidity belongs in hot wallets?
The broader question raised by the Binance incident is not simply “how big is the hot wallet,” but “how the hot wallet is allowed to move.” Idan Ofrat, co-founder and chief product officer at Fireblocks, said exchanges commonly keep enough funds in hot wallets to cover a few days of expected withdrawals. In his account, that often amounts to a low single-digit percentage of assets under management, with the bulk of customer value stored in cold facilities.
Ofrat also described variations in how exchanges operate intermediate layers. Some use intermediary wallets that require manual approval before transferring to hot wallets, creating additional friction when trying to limit the speed of any unauthorized movement.
Other market participants stressed that large hot-wallet balances aren’t automatically a sign of mismanagement. Alex Tobol, chief technology officer at Telegram-based crypto wallet Walt, said holding billions in hot wallets can be normal for an exchange at Binance’s scale. The critical difference, he suggested, lies in whether withdrawals can be processed automatically in a compromised state—or whether replenishing hot liquidity from cold storage requires separate treasury decisions and manual approval.
Hahr pointed to control measures that can contain losses when a system is compromised, including transaction limits, restrictions on approved withdrawal addresses, and additional authorization requirements before funds are signed and broadcast.
Industry pressure after the attack
Binance is not operating in a vacuum. In the wake of the incident, several rivals have publicly disclosed details about cold-storage ratios, including Coinbase, Gate, and Upbit, according to coverage referenced by Cointelegraph. The move reflects how quickly security incidents can reframe what users and regulators consider “basic” disclosure: not only how much an exchange holds, but how that structure maps to risk during an emergency.
Still, the Binance case underlines a limitation of such disclosures. Cold-storage percentages may help describe reserve distribution, but they do not reveal the operational realities of wallet signing services—particularly whether limits were enforced where attackers could bypass them or whether approvals and address restrictions were strong enough to slow the transfer process.
For readers trying to gauge the real lessons from Binance’s incident, the key items to watch next are whether investigators and Binance provide more detail about the signing service’s permissions, how transaction limits were enforced (application-side vs. signing-side), and what compensating controls—if any—were meant to stop unauthorized transfers once access was obtained.
This article was originally published as Binance $6.3B Hack Sparks Scrutiny of Hot Wallet Security Controls on Crypto Breaking News – your trusted source for crypto news, Bitcoin news, and blockchain updates.