🔔 What can we learn from the Binance hack and recovery?

🌐 Binance has begun restoring access after a $6.3 billion theft, drawing on its own reserves to replace customer assets. Its recovery offers lessons about how exchanges approve transactions, communicate during a crisis and demonstrate that customers can get their money back. Binance has expanded withdrawals after reporting that it had replaced approximately 95% of the assets affected by its $6.3 billion October 29 hack.

⚠️ Customers have therefore faced two different recovery processes. Binance has been sourcing replacement cryptocurrency to back their balances, while investigators and industry partners have been trying to recover the assets taken by the attacker. Returning withdrawal access involves a third task: establishing that the systems which send those assets can operate safely. An account balance, a reserve snapshot and a completed withdrawal each answer a different question about the exchange’s condition.

📣 Its published account placed the hot-wallet compromise at approximately 20:05 UTC on October 29. The exchange said it had contained affected infrastructure, revoked authorisations and introduced further controls while investigators worked to establish the sequence of events. The distinction between stealing a key and obtaining permission to use a signing system is central to the investigation. A transaction can carry a cryptographically valid signature even when the business never intended to authorise the transfer.