Binance’s $6.3B Hot Wallet Breach Highlights Limits of Blockchain Data

Nov 06, 2026 914 views

The exposure behind the headline

The key question raised by Binance’s $6.3 billion security incident isn’t how much sat in a hot wallet at one moment. It’s how much an attacker with access to the exchange’s signing process could move over time—and what independent controls could stop them. A wallet balance is a snapshot; an incident unfolds through a sequence of permissions, transactions and operational decisions.

That distinction shapes how the headline figure should be read. The total value of assets affected across multiple blockchains doesn’t, by itself, show how much was exposed at once, how quickly funds could be replenished or which safeguards might have limited the damage. Those details matter to customers trying to understand what happened, and to other exchanges assessing whether their own controls would hold under similar pressure.

Binance co-CEO Richard Teng said on Oct. 30 that the attack involved the exchange’s own hot wallet. Most customer assets were held in cold storage, he said, and moved to hot wallets to fulfill withdrawal requests. That description identifies the broad custody arrangement, but it doesn’t establish how much a compromised signing process could authorize.

Binance’s initial report said attackers gained access to an internal wallet-signing service and moved funds outside the usual withdrawal process. The exchange withheld some technical details, citing the risk of enabling further attacks. It didn’t answer Cointelegraph’s questions about wallet balances or safeguards. That leaves an important gap: observers can trace some of what happened on public blockchains, but they can’t inspect the internal rules that governed each approval.

What the on-chain record can show

CertiK analyst Jonathan Riss said the $6.3 billion figure covered the cumulative value of assets affected across 10 blockchains. On Ethereum, he said, the attackers drained a hot wallet repeatedly as new deposits arrived. That pattern points to exposure that changed over time, rather than a single balance that can be captured in one screenshot.

Those transactions reveal movements, but not the rules inside the signing system. A wallet’s visible balance is only a snapshot; the amount at risk also depends on how much the system permits someone with valid signatures to transfer, and how quickly it can be replenished. Similar systems typically divide responsibility across software, people and custody processes, but public transaction records don’t show how those responsibilities were arranged here.

That distinction matters when assessing transaction limits. A cap enforced by the application requesting a signature could fail if that application is compromised. A separate limit enforced by the signing system may still constrain transfers, Riss said. The location of a control is therefore part of its value: a rule that depends on the compromised component may offer little protection once an attacker has gained access to it.

It’s a technical distinction with a practical consequence. If you’re working in this space, the useful question isn’t simply whether a limit exists, but which system enforces it and whether that system depends on the same credentials or software as the compromised process. A second approval can add friction; it only adds meaningful protection if the attacker can’t bypass or control that approval too.

“A comparison with other exchanges isn’t really possible from the outside,” he said. Reserve distributions and proof-of-reserves attestations can show where assets are held, but they don’t reveal how withdrawals are authorized. Exchanges including Coinbase, Gate and Upbit have disclosed cold-storage ratios since the incident, but those figures don’t settle questions about signing controls. They describe custody at a broad level, not the permissions that determine whether funds can leave a wallet.

BitGo chief product officer Eugene Hahr also declined to guess at Binance’s internal setup. “The breakdown of custody arrangements is a question Binance is best placed to answer,” he said. That’s a sensible boundary: outside observers can discuss general safeguards, but shouldn’t present an exchange’s undisclosed internal design as fact.

Where safeguards can sit

Fireblocks co-founder and chief product officer Idan Ofrat said exchanges typically keep enough in hot wallets for a few days of expected withdrawals, often a low single-digit percentage of assets under management. Most customer funds generally remain in cold storage; some exchanges also use intermediate wallets that require manual approval before funds reach hot wallets. These arrangements aim to keep routine withdrawals moving without leaving all customer assets in a readily accessible wallet.

The tradeoff is operational. Too little available liquidity can make ordinary withdrawals harder to process, while a larger hot-wallet balance can increase the amount immediately exposed if controls fail. The appropriate balance depends on an exchange’s operations, and the figures cited here don’t reveal Binance’s own setup. More useful than a ratio alone is how the exchange controls transfers between storage tiers and what happens when a request falls outside normal patterns.

Alex Tobol, chief technology officer at Telegram-based crypto wallet Walt, said billions in hot wallets aren’t inherently unusual for an exchange of Binance’s size. Withdrawals are often processed automatically, he said, while transfers from cold storage to replenish hot wallets should involve a separate treasury decision and manual approval. The separation matters because it can put another decision point between customer withdrawal activity and the movement of a larger pool of funds.

Hahr pointed to controls that can act before a transaction is signed: transfer limits, approved withdrawal addresses and extra authorization steps. Each addresses a different point in the process. Limits can restrict the value moved; address approvals can narrow where funds may go; extra authorization can require another party or system to participate. The protections depend on how they’re configured and whether they remain independent when the signing service is under attack.

Why the signing process matters

This is more significant than it looks. Cold storage can reduce exposure to routine online threats, but it doesn’t answer what happens when funds are moved into a hot wallet or when an attacker reaches a service that can authorize transfers. The security question follows the asset through that handoff, including who can approve it, what limits apply and whether those checks can be overridden.

(And this is the part most people overlook.) A published cold-storage ratio may reassure customers about where assets are kept while leaving the most consequential operational details unanswered. The incident shows why custody disclosures and security disclosures aren’t interchangeable: one describes asset placement, while the other explains who can move assets and under what conditions.

The breach’s technical details remain limited, but the practical takeaway is clear: public balances can map the flow of stolen funds, while the real measure of exposure lies in the permissions and checks behind each signature. For customers, that means a large cold-storage share alone can’t explain the resilience of an exchange’s withdrawal system. For exchanges, it puts the focus on controls that still work when the software or service initiating a transfer is already compromised.

Hard limits, independent approvals and carefully managed replenishment can reduce the authority concentrated in one service. None of those measures can be confirmed for Binance from the information available here. Until more details emerge, the on-chain record can show where funds moved, but the central question—how far the compromised signing process could reach—remains unanswered.

Magazine: Binance hackers raced to move billions before it could be frozen

Source: Cointelegraph by Helen Partz · cointelegraph.com