Binance's $6.3 billion security incident has left unanswered questions about how the exchange managed its hot wallets and limited the amount of funds attackers could access. The disclosure has drawn scrutiny from security researchers and industry executives, who note that public blockchain data alone cannot establish whether the platform's internal risk controls functioned as intended.

Binance co-CEO Richard Teng said on Oct. 30 that the attack affected the exchange's own hot wallet. Most customer assets were held in offline cold storage and moved to hot wallets only when users requested withdrawals, he said. Hot wallets are internet-connected accounts used to process customer withdrawals, in contrast to offline cold storage.

Wallet balances, however, offer only a partial picture of an exchange's exposure to an attack. Public blockchain records can show funds moving but cannot establish the internal controls governing those transfers, CertiK analyst Jonathan Riss told Cointelegraph.

In its initial report published Tuesday, Binance said attackers accessed an internal wallet-signing service to move funds outside its normal withdrawal process. Such signing services form the core of an exchange's withdrawal infrastructure, authorizing when funds are allowed to move. The exchange said some technical details would remain confidential to prevent further attacks. Binance did not respond to Cointelegraph's questions about its wallet balances and safeguards.

Rivals including Coinbase, Gate and Upbit have disclosed their cold-storage ratios following the attack. Whether more exchanges publish comparable figures, and whether Binance offers further detail on its safeguards, remain open questions as the industry assesses the incident.

What blockchain records can reveal

Riss said the $6.3 billion figure represented the cumulative value of assets affected across 10 blockchains. On Ethereum, attackers repeatedly drained a hot wallet as new deposits arrived.

When attackers can obtain valid signatures, their potential access depends on what the signing system allows them to transfer over time, Riss said. A wallet's balance at a single moment does not capture that exposure.

Transaction limits enforced by the application requesting a signature can be bypassed if that application is compromised, Riss said. Limits enforced independently by the signing system may still restrict transfers.

"A comparison with other exchanges isn't really possible from the outside," Riss added. "Public information on internal signing architecture is limited everywhere, and reserve distribution and proof-of-reserves attestations show what sits where, not how a withdrawal is authorized."

BitGo chief product officer Eugene Hahr also declined to speculate about Binance's internal safeguards. "The breakdown of custody arrangements is a question Binance is best placed to answer," he said.

How much should exchanges keep in hot wallets?

Idan Ofrat, co-founder and chief product officer at Fireblocks, said exchanges typically keep enough funds in hot wallets to cover a few days of expected withdrawals, often representing a low single-digit percentage of assets under management.

Exchanges generally hold the bulk of customer assets in cold storage, while some use intermediate wallets that require manual approval for transfers to hot wallets, he said.

Alex Tobol, chief technology officer at Telegram-based crypto wallet Walt, said holding billions of dollars in hot wallets is not inherently unusual for an exchange of Binance's size. Hot wallets generally process withdrawals automatically, Tobol said, but replenishing them from cold storage should require a separate treasury decision and manual approval.

Hahr said controls applied before signing, including transaction limits, approved withdrawal addresses and additional authorization requirements, can help contain losses when a system is compromised.