Binance’s $6.3 billion hack puts exchange safeguards, not Bitcoin’s network, under scrutiny

The reported $6.3 billion Binance hack highlights a distinction between a breach at a cryptocurrency custodian and a failure of Bitcoin’s network. The central test for the market is whether the exchange delivers on its promise to absorb the losses and protect customer balances.

In an October 30 video, cryptocurrency analyst Joe Consorti said the attack targeted Binance rather than Bitcoin itself. He argued that separating those risks was essential to understanding the incident and its potential consequences.

Consorti said the attackers targeted hot wallets, the internet-connected wallets exchanges use to process withdrawals. Exchanges generally keep most customer assets in offline cold storage and maintain an online working balance. He compared the breach to theft from a cash register rather than a bank vault, citing blockchain intelligence firm TRM Labs as saying most of the stolen funds left within about 20 minutes.

The intrusion appeared more complex than a single compromised device, he said. Citing Binance management, Consorti said investigators initially suspected a compromised laptop but subsequently found additional points of entry. The attackers used an Ethereum delegation feature to transfer control of a hot wallet to their own program, bypassing the exchange’s normal approval checks, according to the account he presented.

Efforts to freeze the stolen assets followed. Consorti said Tether and Circle froze more than $2 billion in tokens, while Binance put the total frozen at about $3 billion. Almost all the frozen assets were stablecoins whose issuers could intervene. By contrast, about 18,000 Bitcoin identified as stolen by on-chain trackers could not be frozen in the same way, he said.

Consorti stressed that Bitcoin’s network checks whether transactions carry valid signatures; it cannot determine whether the person using an exchange’s signing authority is an authorized operator or an attacker. During the theft, he said, Bitcoin continued producing blocks roughly every 10 minutes, with no transactions reversed or network rules changed. The breach concerned the company holding the keys, he argued.

That absence of central control cuts both ways, Consorti said. Just as an issuer cannot freeze the attacker’s Bitcoin, the same principle applies to Bitcoin held by users who control their own private keys. He distinguished the risks of entrusting assets to an exchange from the operation of the underlying network.

To assess the market reaction, Consorti said he examined Bitcoin’s performance during the first five and a half hours after 12 major hacks dating back to 2018. The roughly 4.3% decline following this attack was the second-largest in that comparison, behind Coincheck in 2018. Most other incidents produced moves of less than 1.5%, indicating that the market treated this breach as a serious event, he said.

He nevertheless distinguished the losses from the collapse of FTX in 2022. In that case, customer money had been transferred to an affiliated trading firm, leaving a roughly $8 billion shortfall. Bitcoin fell 23% in two days and bottomed around $15,500 about two weeks later, roughly 25% below its starting level, he said. Binance’s situation differed because the exchange appeared still to hold substantial assets and some stolen funds had already been frozen, according to Consorti.

Reimbursement remained a commitment whose execution still needed to be demonstrated, he cautioned. Consorti said Binance had pledged to cover all losses with company funds, setting aside more than $6.3 billion and holding about $5 billion of that in the same tokens that were stolen. Whether that commitment translates into customers being made whole remained the central unresolved issue in his assessment.