Experts say blockchain records show repeated wallet drains but cannot establish Binance’s internal signing controls or transaction limits.

Binance’s $6.3 billion security incident has left unanswered questions about how the exchange managed its hot wallets and limited the amount attackers could access.

Binance co-CEO Richard Teng said on Oct. 30 that the attack affected the exchange’s own hot wallet. Most customer assets were held in offline cold storage and moved to hot wallets only when users requested withdrawals.

Wallet balances offer only a partial picture of an exchange’s exposure to an attack. Public blockchain records can show funds moving but cannot establish the internal controls governing those transfers, CertiK analyst Jonathan Riss told Cointelegraph.

In its initial report Tuesday, Binance said attackers accessed an internal wallet-signing service to move funds outside its normal withdrawal process. Binance said some technical details would remain confidential to prevent further attacks.

The exchange did not respond to Cointelegraph’s questions about its wallet balances and safeguards.

Rivals including Coinbase, Gate and Upbit have disclosed their cold-storage ratios following the attack.

Riss said the $6.3 billion figure represented the cumulative value of assets affected across 10 blockchains. On Ethereum, attackers repeatedly drained a hot wallet as new deposits arrived.

When attackers can obtain valid signatures, their potential access depends on what the signing system allows them to transfer over time, he said. A wallet’s balance at a single moment does not capture that exposure.

Transaction limits enforced by the application requesting a signature can be bypassed if that application is compromised, Riss said.

Source link