Key facts
- CertiK analyst Jonathan Riss said the $6.3 billion figure is the cumulative value of assets affected across 10 blockchains.
- Riss said attackers repeatedly drained an Ethereum hot wallet as new deposits arrived.
- Riss said transaction limits set by the requesting application can be bypassed if that application is compromised.
- Fireblocks co-founder Idan Ofrat said exchanges typically hold a low single-digit percentage of assets under management in hot wallets.
- Binance said some technical details would remain confidential to prevent further attacks.
- Walt CTO Alex Tobol said holding billions in hot wallets is not inherently unusual for an exchange of Binance's size.
Binance has not answered questions about how it managed hot wallets during a $6.3 billion security incident, Cointelegraph reported on November 6, 2026. The exchange's co-CEO, Richard Teng, said on October 30 that the attack affected Binance's own hot wallet, and that most customer assets were held in offline cold storage and moved to hot wallets only when users requested withdrawals.
In its initial report on Tuesday, Binance said attackers accessed an internal wallet-signing service to move funds outside its normal withdrawal process. Binance said some technical details would remain confidential to prevent further attacks. The exchange did not respond to Cointelegraph's questions about its wallet balances and safeguards.
CertiK analyst Jonathan Riss told Cointelegraph that the $6.3 billion figure represented the cumulative value of assets affected across 10 blockchains. On Ethereum, he said, attackers repeatedly drained a hot wallet as new deposits arrived. Riss said that when attackers obtain valid signatures, their potential access depends on what the signing system allows them to transfer over time, and that a wallet's balance at a single moment does not capture that exposure.
Transaction limits enforced by the application requesting a signature can be bypassed if that application is compromised, Riss said, while limits enforced independently by the signing system may still restrict transfers. "A comparison with other exchanges isn't really possible from the outside," he said. "Public information on internal signing architecture is limited everywhere, and reserve distribution and proof-of-reserves attestations show what sits where, not how a withdrawal is authorized."
BitGo chief product officer Eugene Hahr declined to speculate about Binance's internal safeguards, saying the breakdown of custody arrangements is a question Binance is best placed to answer.
Fireblocks co-founder and chief product officer Idan Ofrat said exchanges typically keep enough funds in hot wallets to cover a few days of expected withdrawals, often a low single-digit percentage of assets under management. He said exchanges generally hold the bulk of customer assets in cold storage, while some use intermediate wallets that require manual approval for transfers to hot wallets.
Alex Tobol, chief technology officer at the Telegram-based crypto wallet Walt, said holding billions of dollars in hot wallets is not inherently unusual for an exchange of Binance's size. Hot wallets generally process withdrawals automatically, he said, but replenishing them from cold storage should require a separate treasury decision and manual approval. Hahr said controls applied before signing, including transaction limits, approved withdrawal addresses and additional authorization requirements, can help contain losses when a system is compromised.
Rivals including Coinbase, Gate and Upbit have disclosed their cold-storage ratios following the attack.