Key Soundness Indicators Include Resources to Cover Losses
"Proof of Reserves Doesn't Mean You Can Withdraw"
Digital Asset Firms Should Also Establish Internal Operational Controls

After Binance, the world's largest cryptocurrency exchange, was hacked, it used resources beyond its emergency fund to cover the stolen assets. The incident has prompted calls for exchanges to maintain sound finances and operations to withstand cyberattacks.

On November 5, Bitplanet Research Lab, a digital asset treasury (DAT) company, identified three key indicators for assessing an exchange's soundness in its recent report, "Assessing the Soundness of Cryptocurrency Exchanges: Responding to Major Hacks and Institutional Operational Risks": resources to cover losses, the practical ability to process withdrawals, and the ability to respond to liquidity needs.

Bitplanet first said that although Binance was working to recover its losses, it had yet to reach a point where customers could withdraw their assets immediately under normal conditions. On November 2, Binance published proof of reserves (PoR) showing reserve ratios of more than 100% for 10 major assets, including Bitcoin and Ethereum. However, as of November 3, only 23 of the 72 possible combinations of those 10 major assets and their networks allowed withdrawals. Bitplanet explained that restoring withdrawals to normal could not happen immediately because it takes time to safely transfer funds to hot wallets, which handle external transfers, and complete security checks. It added that proof of reserves only verifies an exchange's asset holdings at a specific point in time and the level of backing relative to customer balances; it does not certify the exchange's overall potential liabilities or financial soundness.

Bitplanet also outlined five conditions for determining whether the Binance hack had been brought under control: whether all assets had been recovered, withdrawals on major networks had returned to normal, the exchange could handle large net outflows, the Secure Asset Fund for Users (SAFU) was adequately funded, and the cause of the incident and the approval system had been addressed. To cover losses of about $6.3 billion (KRW 8.4527 trillion), Binance allocated $6.34 billion in corporate funds and secured 95% of the stolen amount by combining half of SAFU's holdings (7,499 Bitcoin), surplus funds in its futures insurance fund, and its own corporate funds. It is conducting over-the-counter purchases to cover the remaining 5% in low-liquidity tokens. Bitplanet said, "If withdrawal delays continue for customers who deposited those unrecovered tokens, distrust could deepen."

It also warned that, with withdrawals available for only 27 assets, a bottleneck could become entrenched, preventing deposited assets from being transferred to safe external custodians. Binance has seen withdrawals totaling about KRW 6.32 trillion so far. Bitplanet said the amount could grow as withdrawal access expands, potentially placing greater strain on hot-wallet liquidity. It also warned that, because SAFU remains about half short of its target funding level, Binance may find it harder to respond to another unexpected security incident. Finally, it stressed the need for measures to prevent a recurrence, including addressing the route through which the exchange was hacked.

Bitplanet also argued that, in light of the incident, companies and institutions holding digital assets should strengthen their internal operational controls, including separating approval authorities and establishing emergency withdrawal channels. It noted that the incident resulted not from a breach of the blockchain protocol or theft of private keys, but from the compromise of the exchange's internal operating environment and transaction approval system. The incident showed that if an intruder who gains access to an operating system can bypass controls and obtain final withdrawal approval, the damage can spread across an entire system that shares approval pathways, even if its wallets and blockchains are physically separated.

Hot Picks Today

Bitplanet outlined six criteria that exchanges and custodians should review. First, it said they should separate approval authorities by fully distinguishing access to operating systems from approval to transfer assets and ensuring that approvers are independent of one another. It also called for multiple approvals when withdrawing large amounts of assets or changing wallet permissions. It recommended setting withdrawal limits by cumulatively tracking amounts or transaction counts over time, and enabling automatic temporary withdrawal suspensions when suspicious transactions are detected. It also said firms should physically distribute assets, manage the proportion held in cold wallets, and secure alternative withdrawal channels and reserve liquidity. Finally, it called for verification of their practical ability to meet payment obligations, internal operational controls, and service continuity after an incident.

© The Asia Business Daily. All rights reserved. Unauthorized AI training and use prohibited.