Binance’s $6.3 Billion Hack Raises Questions About Hot Wallet Security Controls

Binance’s $6.3 billion security incident has raised questions about how the exchange protected its hot wallets and restricted the amount attackers could access.
Co-CEO Richard Teng said on October 30 that the attack targeted Binance’s own hot wallet. Most customer assets were held in offline cold storage and transferred to hot wallets only when users requested withdrawals.
Blockchain records show repeated wallet drains across 10 blockchains, but they cannot reveal Binance’s internal signing architecture, authorization procedures or transaction limits. CertiK analyst Jonathan Riss said the $6.3 billion figure represented the cumulative value of affected assets. On Ethereum, attackers repeatedly drained a hot wallet as new deposits arrived.
Binance said attackers accessed an internal wallet-signing service to move funds outside the normal withdrawal process. The exchange declined to disclose certain technical details, citing security concerns.
Industry experts said exchanges typically keep only enough assets in hot wallets to cover a few days of expected withdrawals, often representing a low single-digit percentage of assets under management. The majority is generally held in cold storage.
Experts also emphasized that transaction limits, approved withdrawal addresses and additional authorization requirements can help contain losses. However, protections enforced by a compromised application may be bypassed if the signing system does not independently enforce those restrictions.