Hot Wallet Security Questions Emerge Following Binance's $6.3B Breach
Blockchain data reveals continuous depletion of wallets, yet analysts cannot determine what internal authorization protocols or transfer restrictions Binance had implemented.
The $6.3 billion breach at Binance has raised critical concerns regarding the platform's hot wallet management practices and the mechanisms in place to restrict unauthorized fund access by malicious actors.
On Oct. 30, Richard Teng, Binance's co-CEO, confirmed that the breach targeted the platform's proprietary hot wallet infrastructure. He explained that the majority of user funds remained secured in offline cold storage facilities, with assets transferred to hot wallets exclusively upon withdrawal requests from customers.
According to CertiK analyst Jonathan Riss in his statement to Cointelegraph, examining wallet balances provides an incomplete understanding of a cryptocurrency exchange's vulnerability during security incidents. While public blockchain ledgers display asset movements transparently, they fail to reveal the internal authorization mechanisms that regulate those fund transfers.
According to Binance's preliminary disclosure released Tuesday, the perpetrators gained unauthorized entry to an internal signature service for wallets, enabling them to relocate assets outside the platform's standard withdrawal procedures. The exchange indicated that certain technical specifications would be withheld from public disclosure as a protective measure against subsequent security breaches.
Cointelegraph's inquiries to the exchange regarding wallet balance information and security protocols went unanswered.
Competing platforms such as Coinbase, Gate and Upbit have publicly shared information about their cold-storage allocation percentages in the aftermath of the security incident.
What blockchain records can reveal
According to Riss, the total $6.3 billion figure reflects the aggregate value of compromised digital assets distributed across 10 different blockchain networks. Specifically on the Ethereum network, malicious actors continuously emptied a hot wallet in successive transactions as fresh deposits continued to flow into the account.
He explained that when adversaries successfully acquire legitimate cryptographic signatures, their capacity to access funds is determined by the parameters the signing infrastructure permits them to transfer during a given timeframe. The balance visible in a wallet at any single point in time fails to accurately represent the total potential exposure.
According to Riss, transaction restrictions implemented at the application layer that requests signatures can be circumvented if that particular application becomes compromised. However, limitations enforced autonomously by the signing infrastructure itself may continue to provide protection by restricting unauthorized transfers.
A comparison with other exchanges isn't really possible from the outside. Public information on internal signing architecture is limited everywhere, and reserve distribution and proof-of-reserves attestations show what sits where, not how a withdrawal is authorized.
Jonathan Riss, CertiK analyst
Eugene Hahr, who serves as chief product officer at BitGo, similarly refrained from offering conjectures regarding Binance's internal security measures.
The breakdown of custody arrangements is a question Binance is best placed to answer.
Eugene Hahr, BitGo chief product officer
How much should exchanges keep in hot wallets?
According to Idan Ofrat, who holds the positions of co-founder and chief product officer at Fireblocks, cryptocurrency exchanges normally maintain sufficient capital in hot wallets to accommodate several days' worth of anticipated withdrawal activity, which frequently amounts to a small single-digit percentage of total assets under management.
He noted that exchanges customarily store the vast majority of customer deposits in cold storage environments, while certain platforms deploy intermediate wallet solutions that mandate manual authorization before transferring funds to hot wallet infrastructure.
According to Alex Tobol, chief technology officer at Telegram-based cryptocurrency wallet provider Walt, maintaining billions of dollars worth of assets in hot wallet storage is not necessarily abnormal for a trading platform operating at Binance's substantial scale.
While hot wallets typically handle withdrawal requests through automated processes, Tobol emphasized, the replenishment of those wallets using funds from cold storage infrastructure should necessitate a distinct treasury management decision accompanied by manual authorization procedures.
Hahr emphasized that protective measures implemented prior to the signing process, encompassing transaction threshold limits, pre-authorized withdrawal destination addresses and supplementary authorization protocols, can effectively minimize financial losses when a system experiences a security compromise.