On Oct. 29, about $6.3 billion (roughly KRW 8 trillion) worth of crypto was drained from the hot wallet (a wallet connected to the internet, where withdrawals go out immediately) of Binance, the world's largest crypto exchange. The U.S. Federal Bureau of Investigation (FBI) pointed to North Korea.
The first question for Korean investors is, “Is my exchange safe?” The numbers are reassuring. As of the end of September, Upbit kept 99.17% of customer crypto and Bithumb kept 94.76% in cold wallets (wallets kept offline).
But the key point lies elsewhere. Binance also said it keeps most customer assets in cold wallets. That share has not been disclosed, so it can't be verified. The hackers didn't go after the wallet itself. They went after the people with withdrawal approval authority and their computers.
- The $6.3 billion hack (about 8 trillion won) began with a fake interview task file
According to Binance's account of the incident, released Nov. 3, a software engineer was contacted in September through a legitimate job site. A fake recruiter held a video interview, and the fake interview assignment file that followed hid malware that security software failed to catch.
On Oct. 20, the hacker used this computer and an in-house AI tool to break into the computers of two more engineers who handle the wallets. These engineers held withdrawal approval authority, and that is how the hacker got it. Nine days later, on Oct. 29, the hacker ran malicious software with access credentials stolen from these computers and ordered withdrawals from the hot wallet. Blockchain analytics firm TRM Labs estimated that the hacker moved most of the funds in about 20 minutes.
Think of an apartment building's security desk. No matter how thick you make the vault door, it's useless if the guard holding the keys lets a stranger in. Binance said it blocked 57 attacks this year that appeared to be linked to North Korea.
- Does a high cold-wallet ratio stop hacks?
A cold wallet is like a bank's basement vault, and a hot wallet is like a teller's drawer. Coins in the vault are offline and hard to steal remotely, but the portion that must be handed out the moment a customer taps withdraw is kept in the teller's drawer, the hot wallet. In this article, we call the portion of coins held in that drawer the “hot wallet share.” Korea's Virtual Asset User Protection Act requires exchanges to keep at least 80% of customer crypto, by economic value, in cold wallets.
All five exchanges that the Financial Services Commission (FSC) called to an emergency meeting on Nov. 2 were above this line as of the end of September: Upbit at 99.17%, Bithumb at 94.76%, Coinone at 85.00%, DigitalX (formerly Korbit) at 82.79% and GOPAX at 80.54%. Converted to a hot wallet share, that is 0.83% for Upbit and 19.46% for GOPAX. If you deposited KRW 10 million of crypto and it were split in these proportions, about KRW 80,000 would sit in the hot wallet at Upbit and about KRW 1.95 million at GOPAX.
Simply put, the higher the ratio, the smaller the hot wallet share exposed to hacking. But the cold wallet ratio only tells you how big the hot wallet share is. It doesn't tell you who holds the withdrawal approval authority. Binance also said it keeps most customer assets in cold wallets (the ratio hasn't been disclosed, so it can't be verified), yet KRW 8 trillion went out from the hot wallet alone.
- What the FSC examined was "who approves withdrawals"
On Nov. 2, the FSC held an emergency meeting with the Financial Supervisory Service, the Financial Security Institute, Upbit, Bithumb, Coinone, DigitalX and GOPAX. The review focused on computer access controls, the wallet withdrawal approval and signing system, and management of administrator privileges. Withdrawal approval and signing is the step that confirms “it's OK to send” when coins leave the exchange.
What was cited in the Binance incident at the Nov. 2 meeting was also a breach of employees' work laptops and abuse of withdrawal approval and signing authority. If a hacker takes over a computer with withdrawal approval authority, the exchange's system treats that withdrawal as legitimate. It's like taking over the desk of the employee who holds the stamp: documents with the real stamp pass straight through. Conversely, if withdrawal approval requires several people and several steps, coins can't leave even if one computer is breached.
Along with a larger cold wallet share, the FSC called for constant monitoring of deposits and withdrawals, enough response staff, and prompt reporting of abnormal access attempts. It also said it will push for reforms that apply security measures on par with banks and other major financial firms to exchanges.
- If a breach still happens, what covers the loss?
Binance said it froze about $2.85 billion and covered about 98% of the stolen coins with company funds. The money an exchange sets aside in advance to cover losses from incidents like this is called a reserve.
At this meeting, the FSC also reviewed insurance coverage and reserves and proposed setting aside additional reserves. Its position is that it will oversee exchanges so users are protected, including full compensation when losses occur. Still, some point out that small and mid-sized exchanges with low profits find it hard to fund both security investment and incident reserves.
- BITPRESS Insight
A 99% cold wallet ratio means “the share exposed to hacking is small,” not “hacking is prevented.” The Binance hack got in not through the vault walls but through the computer of a person with withdrawal approval authority, which is why the FSC checked withdrawal approval authority along with the ratio.
So the question for judging an exchange's safety changes too. More important than how much is in the vault, for protecting your coins, is whether withdrawals can go out if just one person or one computer is breached, and whether there is money to cover losses if it happens. That is why you should ask about an exchange's withdrawal approval process and reserves when choosing one.
Sources
https://www.coindesk.com/business/2026/11/03/binance-s-usd6-3-billion-hack-began-with-a-fake-job-interview-exchange-says
https://www.theblock.co/news/business/2026-11-03-binance-hack-incident-report-north-korea-fake-job-interview-ai-tool-432406
https://www.etnews.com/20261102000362
https://www.dailian.co.kr/news/view/1709669/----2026
https://newsway.co.kr/news/view?ud=2026110310535872528
https://cointelegraph.com/news/south-korea-urges-exchanges-to-boost-cold-storage-after-binance-hack
Glossary
cold wallet — A crypto wallet kept offline. It is hard to hack remotely, but it takes time to access.
Hot wallet — A wallet connected to the internet that handles customer withdrawals immediately, which also makes it exposed to hacking.
Withdrawal approval and signing — The step in which an authorized person and system confirm “it's OK to send” when an exchange moves coins out.
Malware — A program designed to secretly control a computer or steal information from a user.
Virtual Asset User Protection Act — A Korean law that sets how crypto exchanges must store and protect customer coins.
BITPRESS articles are information to help your investment decisions, not a recommendation to buy or sell any stock or coin. Investment decisions and their results are your own responsibility.
