The recent $6.34 billion incident at cryptocurrency exchange Binance raises a critical question for financial services QA teams: can emergency controls stop transactions authorised outside the firm’s own systems?
Binance’s disclosure that suspending withdrawals could not stop all unauthorised asset movements has put the effectiveness of emergency controls under scrutiny, raising wider questions about how financial institutions test their ability to contain a breach.
In its preliminary report published on 3 November, the exchange said approximately $6.4 billion in digital assets had been affected by the 29 October incident.
Attackers had accessed an internal wallet signing service and established malicious permissions on Ethereum that operated independently of its normal withdrawal infrastructure.
“Binance needed additional transactions to revoke these on-chain authorisations,” the exchange said.
For banks and fintechs assessing digital asset custody, the assurance issue extends beyond whether a provider can suspend customer activity. It concerns whether that intervention removes every remaining route through which an attacker can exercise control.
A shutdown test can demonstrate that an application has stopped accepting instructions while leaving unanswered whether previously granted authority can still be used elsewhere.
Permissions
The Ethereum mechanism involved, EIP-7702, allows an account to delegate execution to smart contract code. That delegation persists until it is changed or cleared; stopping an application does not itself remove the account’s on-chain configuration.
The specification also warns that delegated code has unrestricted access to the account, making the choice and verification of that code particularly consequential.
This creates a distinct testing requirement. Assurance teams need to examine both the systems that issue permissions and the environments in which those permissions remain effective.
A controlled exercise could establish a delegation, disable the normal transaction service and then attempt to use the delegated authority.
The purpose would be to determine precisely what the shutdown prevents, what remains possible and which further actions are required to contain the exposure.
The same principle can inform testing beyond digital assets. Wherever a workflow grants another component continuing authority, disabling the originating service should trigger a separate check of whether that authority survives.
The implementation will differ across platforms, but the question remains whether the control reaches the place where an action can still be executed.
Can the emergency procedure still run?
Binance said its multiparty computation arrangements complicated revocation, requiring a specialised procedure. Its final unauthorised transfer, of 2,961.9 ETH, finalised at 23:56 UTC after having been broadcast earlier. The delegation was cleared at 00:10 UTC on 30 October.
For QA teams, this introduces a second dimension to containment testing: whether the corrective action remains available under the conditions created by the incident itself.
An emergency procedure may depend on signing components, authorised staff, network connectivity or infrastructure that responders have isolated.
A credible exercise should therefore establish whether the organisation can still perform the actions needed to regain control when parts of its normal operating environment are unavailable or untrusted.
That does not justify weakening signing safeguards to make emergency intervention easier. It calls for a recovery mechanism whose security and availability can be demonstrated together.
Testing should also distinguish an instruction submitted from an instruction successfully executed. Where revocation requires an external transaction, an internal confirmation that the request has been sent is insufficient evidence that the authority has ceased to exist.
The relevant endpoint is a verified change in the environment where the permission operates.
Pending transactions change the test
The distinction between submission and completion also matters for transactions already in flight.
An exercise that starts with an empty queue could give an incomplete picture of containment. A more demanding scenario would include pending transactions, active delegations and an attacker continuing to issue instructions while defenders attempt to revoke access.
The evidence should show which actions remained executable, when the relevant controls became effective and whether any transactions completed after intervention began.
This would support more meaningful measures than the time taken to disable a service alone. Teams could measure the interval between detection and effective revocation, identify dependencies that delayed containment and record residual exposure during that period.
These are proposed assurance measures, rather than findings about the tests Binance had conducted. The exchange’s investigation remained preliminary and subject to independent review.
Custodian assurance
For institutions using external custody providers, the practical challenge is obtaining enough evidence to assess these capabilities without requiring access to sensitive security designs.
A statement that emergency controls exist provides limited assurance about how they behave during a live compromise. More useful evidence would include the scope of containment exercises, the conditions under which revocation was tested, the time taken to verify its completion and the treatment of exceptions.
Responsibility also needs to be explicit. The client institution should understand which actions it can initiate, which require the custodian and which depend on another party. Those dependencies should form part of the exercise.
Coverage across networks deserves particular attention. Demonstrating that one asset or wallet can be contained does not establish that a different execution model will respond to the same intervention. The test scope should reflect the actual services and assets the institution uses.
The broader implication is to define emergency controls by their demonstrated effect on financial exposure. A successful shutdown exercise should establish which transactions and permissions have been stopped, which remain active and how the remaining exposure will be contained.
The decisive evidence is whether an attacker’s authority has ceased to work.
SEE YOU THIS MONTH IN LONDON?
Why not become a QA Financial subscriber?
It’s entirely FREE
* Receive our weekly newsletter every Wednesday * Get priority invitations to our Forum events *
READ MORE
- Binance hack exposes shutdown assurance gaps
- Sonar, Katalon and Thunders: latest vendor news
- AI agents accessing bank accounts raise awkward testing questions
- AI insurance doubts raise banks’ testing stakes
- Starling’s 17-sec AI sleuth puts QA on the clock
