After the US$3B Freeze: Why the Future of Custody is about Governance, Not Just Technology

The market’s first question is always the number: how much has Binance lost? But the figure is only part of the story.

Binance’s preliminary investigation points not to confirmed private-key leakage, but to a less visible pathway: signatures and authorisation.

Custody is shifting from a contest over technical hardness to one of verifiable governance. For RWA structures that rely on off-chain registration, that governance extends to an off-chain register.

1. What happened: attention turns to signatures and authorisation

The public timeline, based on Reuters, the Associated Press and TechCrunch, begins at around 20:30 UTC on 29 October (around 04:30 Beijing time on 30 October), when Arkham’s CEO said on-chain data pointed to unusual activity. Changpeng Zhao subsequently wrote that the incident “looked like a hack” against Binance. Binance confirmed an investigation but, as of the relevant reports, had not explicitly confirmed that funds had been stolen. It subsequently suspended withdrawals on multiple networks. Around two hours later, the verified total frozen stood at US$2.54 billion, while Tether and Circle separately disclosed related measures. On 30 October, Binance said US$3 billion had been frozen and that the figure could increase.

Binance’s subsequent preliminary investigation, reported by Cointelegraph as of 02:44 UTC on 30 October, added further detail. The estimated amount of affected assets was approximately US$6.3 billion—not a final net loss or user-loss figure—of which around US$3 billion had been frozen. Preliminary leads pointed to the compromise of a DevOps engineer’s laptop, access to a service container and the submission of unauthorised withdrawal transactions. Binance said it had found no evidence of wallet private-key leakage. Blockaid’s CEO similarly described the incident as appearing to involve signing infrastructure rather than compromised keys. These are preliminary findings and industry views, not a final account of the attack path.

Before going further, one distinction is essential: assets frozen are not the same as losses incurred.

Table 1 | Three commonly conflated measures. Source: EX.IO Research Institute

Combining figures from different times, institutions and methodologies, and presenting the result as user losses, is analytically unsound. These distinctions are not semantic housekeeping; they are the starting point for risk analysis.

More important than the headline figure is the current technical focus. As of the preliminary disclosures, Binance said it had found no evidence of wallet private-key leakage. Public information directs attention to the operational chain of people, endpoints, containers and withdrawal authorisation, but the full attack path and impact remain subject to final investigation. Cold storage can reduce online private-key exposure; it cannot, on its own, eliminate operational risks in endpoint security, permissions and authorisation workflows. That is the industry’s key lesson.

2. Potential spillovers: why this is not only Binance’s issue

1. Market makers may reassess settlement and counterparty risk. Market makers’ quotes, collateral and liquidity positions may involve major centralised exchanges. When settlement safety is questioned, the issue is not only how much has been lost, but whether settlement can continue. If major market makers reduce their willingness to quote, bid-ask spreads could widen and order-book depth could fall. This is a market-microstructure scenario, not an assertion of observed fact; spread, depth and position data are required for verification. The broader issue is trust in market infrastructure, with price volatility only one possible reflection.

2. Stablecoin freezability: a safeguard and a boundary of power. Tether and Circle disclosed freezing measures involving assets including USDT and USDC. Assets on the same public blockchain do not necessarily have the same degree of resistance to intervention. For victims and platforms, freezability can provide time for investigation and potential recovery. For users who prioritise censorship resistance, it demonstrates that issuers can affect whether assets remain usable. The question is not simply whether freezing is good or bad, but whether the power is governed by clear rules, auditable procedures and accessible remedies. The greater the emergency power, the stronger its governance should be.

3. A trust deficit spills over as a cross-institutional containment network emerges. The response extends beyond Binance. Exchanges pause services, stablecoin issuers freeze addresses, custodians cooperate and blockchain analytics teams trace asset flows. Containment is becoming a coordinated, cross-institutional exercise. Yet a denser network requires higher standards: what evidence triggers a freeze, who confirms address attribution, how are innocent parties protected, and when are users and counterparties notified? Without clear answers, emergency efficiency can create governance risks of its own. Institutional expectations of custody are likewise shifting from assurances of safety to third-party verifiability.

3. Governance underpins containment: EX.IO’s custody framework

If preliminary information points to signatures and authorisation, a licensed custodian’s security perimeter must comprise more than stronger cold wallets; it requires verifiable governance. Using EX.IO, an SFC-licensed virtual asset trading platform (VATP), as an example, the following arrangements are based on company disclosures. Licences, insurance, audits and controls remain subject to the latest effective documents:

Authorisation governance: Role-based permissions, operating records, withdrawal approvals and limits are important due-diligence items for assessing authorisation and operational risk, and form a first line of institutional control.

Asset segregation: SFC client-asset requirements for VATPs call for client assets to be held in segregated accounts or on trust. Balance-sheet treatment must be assessed separately under the applicable accounting standards.

Cold storage: Under the SFC’s Guidelines for Virtual Asset Trading Platform Operators, platform operators and associated entities are generally required to hold 98% of client virtual assets in cold storage, subject to limited circumstances permitted by the SFC. EX.IO’s public custody page also states that 98% of assets are held in offline cold wallets.

Insurance and audit: Digital Asset Custody insurance is underwritten by OneInfinity by OneDegree, with the actual total insured amount potentially reaching a maximum of US$250.45 million, subject to policy terms and exclusions; periodic asset and financial audits are conducted by a third-party accounting firm.

Expanded business scope: According to EX.IO’s June 2026 announcement, its custody authorisation was extended to virtual assets and tokenised securities not traded on its own platform.

The trust shock at a major exchange has made five due-diligence categories more important for institutional decision-making: licensing, segregation, insurance, audit and authorisation governance. Binance’s commitments on loss coverage and further disclosure should be assessed against formal announcements and implementation. If an updated proof of reserves is published, it may provide partial asset information, but it cannot replace a full financial audit or verification of authorisation governance. Disclosure quality is itself security infrastructure: separating confirmed facts, party statements, third-party estimates and unresolved questions, with timestamps and sources, is more conducive to durable trust than an unqualified assurance of absolute safety.

4. Governance extends to the register: RWA’s off-chain ledger

Custody asks whether assets can be held safely. Certain RWA structures that use off-chain rights registration add a distinction worth making: loss of control over an on-chain token does not necessarily extinguish the underlying legal right.

Transfers of native on-chain assets primarily depend on private-key control. A lost key may make assets inaccessible; a stolen key may enable unauthorised transfers. In some RWA structures, legal rights are recorded in an off-chain register maintained by a fund administrator, registrar or licensed trust or corporate service provider. The token digitally represents the underlying interest, while rights must be assessed alongside the register, offering documents and applicable law.

When a private key is lost or stolen, the immediate issue is impaired on-chain control. Whether tokens can be frozen, cancelled or reissued, and the corresponding rights restored, depends on the register, reconciliation, offering terms and applicable law, including the required verification and legal procedures. These arrangements do not guarantee recovery. They represent a different risk structure from native on-chain assets.

This reasoning depends on three conditions: a verifiable legal link between token and underlying asset; an independently maintained register reconciled periodically with on-chain balances; and offering documents containing freeze, cancellation and reissue provisions. Without any one of these, the conclusion does not follow. Even when all are present, recovery is not assured.

This does not make RWA risk-free. Issuer or manager default, register integrity, legal enforcement and secondary-market liquidity risks remain. The risk profile simply extends beyond a single private-key point of failure to institutions and counterparties.

For RWA structures using off-chain registration, tokens circulate on-chain, but rights must still be assessed against the register and offering documents. That distinction—not an assumption of guaranteed recovery—is what the market may reassess after this incident.

Conclusion: a due-diligence checklist for institutions

A mature market is not one without incidents, but one in which facts can be verified, risks isolated and responsibilities traced. Institutions assessing custody and RWA can begin with three questions:

Who holds the private keys and who can authorise withdrawals unilaterally? Are multisignature controls, limits and segregation of authority in place?

Who pays after an incident, how much, and what are the policy exclusions? Can the compensation arrangement be externally verified?

Where are legal rights recorded: primarily through private-key control, or through an on-chain certificate combined with an off-chain register and reissue mechanism?

Sources

1. Reuters — Crypto exchange Binance freezes assets after $6.3 billion security incident
2. Associated Press — Binance flags ‘potential security issue,’ says crypto firms froze more than $2.5B
3. TechCrunch — Binance pauses withdrawals as hackers suspected of stealing billions in crypto
4. Cointelegraph — Binance points to engineer’s hacked laptop in $6.3B breach (updated 02:44 UTC, 30 October)
5. Cointelegraph — Live updates: Binance says $6.3B hack involved compromised engineer’s laptop (rolling updates; figures may change)
6. Hong Kong SFC — Guidelines for Virtual Asset Trading Platform Operators
7. EX.IO — Virtual Asset Custody page; June 2026 announcement on approval of independent custody services
8. EX.IO — EX.IO Further Strengthens Digital Asset Custodial Insurance with OneInfinity by OneDegree Providing Up to USD 250 Million (16 April 2026)

Disclaimer

This material has been prepared by EX.IO Research Institute from public sources for general market information and education only. It does not constitute investment, legal, compliance or trading advice, an offer, solicitation or recommendation. Digital assets and tokenised products are volatile and high risk; investors may lose all of their capital, and past performance is not indicative of future results. This article contains forward-looking and analytical judgements. Information concerning Binance and other third parties is based on public sources and has not been independently verified. EX.IO Research Institute is part of EX.IO, and this article discusses the company’s business and products. Nothing herein guarantees or independently verifies any platform’s security, solvency, asset safety or loss-coverage arrangements. Certain products mentioned, including tokenised securities, are available only to professional investors (PI). Data are current to 02:44 UTC on 30 October 2026; the incident remains developing and figures may change. Consult qualified professional advisers for legal, compliance, tax or investment decisions.