Hot Wallet Monitoring for Exchanges and Custodians

Video transcript

A hot wallet can be drained without a stolen key. The tell is valid signatures on transactions nobody requested.

On October 29, about 6.36 billion dollars left Binance wallets, most of it in about 20 minutes. Binance says its signing service was used outside the normal withdrawal process.

The answer: reconcile hot wallets with the ledger in real time, and alert on any outflow your systems did not request.

Start with five rules per wallet and asset, covering outflows, balances, velocity, new destinations and fan-out. Set velocity per wallet, not just per user.

Then watch the signing stack: requests that skip the withdrawal service, policy changes, new signers, deployments outside a release, and delegations. Binance says the attacker used an engineer's deployment token.

Hong Kong's SFC calls for real-time reconciliation. Korea's FSC said exchanges will be required to reconcile every five minutes, with large mismatches tripping a kill switch.

Pausing withdrawals is not always enough. Binance says it did not automatically invalidate onchain authorizations. Halt the signer, scoped by wallet, asset and chain.

Script the first moves: halt signing, check live delegations, send issuers the receiving addresses, rotate credentials, preserve logs. TRM says Tether's first freeze came 37 minutes after the main sweep.

Guardian pentests signers and infrastructure, and Managed Security monitors around the clock. Read the full guide, or talk to Guardian at guardian.security.

On October 29, 2026, about $6.36 billion left Binance wallets, per TRM Labs, most of it in about 20 minutes.

Binance says it began investigating after "an internal alert regarding large-volume transfers." The attacker had used an internal signing service "to initiate transactions outside the normal withdrawal process."

That is the case hot wallet monitoring exists for: valid signatures on transactions nobody requested.

Our Binance hack explainer has the timeline. This guide covers the alerts.

The Hot Wallet Threat Model

Hot wallets sign automatically, so the hot balance is roughly what an attacker can drain fast. Our guide to hot, warm and cold wallets covers how tiers split assets.

A hot wallet can be drained without a stolen key. The ways in to watch:

• The signer, called directly: bypassing the withdrawal system, as Binance describes.
• A changed policy: a raised limit, a new allowlisted address, a new approver.
• Delegated rights: authorizations that outlive a withdrawal pause.
• Trusted accounts and API keys: withdrawals that pass every check.
• Dependencies: wallet vendors, libraries and the pipeline that deploys the signer.

So monitor from the chain inward. Every alert below compares what the chain shows with what your systems intended.

Balance, Velocity and Destination Rules

Start with five rules for each hot wallet and asset:

Set velocity per wallet, not just per user. A per-user cap does nothing against a drain of the wallet itself.

The first rule matters most. Tag every legitimate outflow with a withdrawal, sweep or rebalance ID before it is signed.

Anything onchain without one is an incident until proven otherwise.

Calibrate with the people who run the wallets. Hong Kong's SFC sets this out in an August 2025 custody circular for licensed trading platforms.

It says the security operations center (SOC) should work closely with wallet, operations and technology experts "to regularly assess and refine alerts and their parameters."

For the controls before signing, such as allowlists and delays, see exchange withdrawal security controls.

Signing Infrastructure Alerts

The same circular says platforms should be able to detect intrusions into critical wallet infrastructure. It names the cold wallet vault, "signing devices, databases, production binaries, and code repositories."

For a hot wallet, that means alerts on:

• Signing requests that did not come from the withdrawal service.
• Policy engine changes: limits, rules, approvers and allowlists.
• Signer set changes: new key shares, devices or co-signers.
• Deployments to the signing service outside a release.
• New tokens or credentials that can deploy to it.
• Delegations and approvals granted by a hot wallet.

Binance's account shows why deployments belong on the list. It says the attacker found an engineer's container deployment token, then "deployed a container, and triggered a malicious script to launch the attack."

Delegations need their own rule. TRM advises that "Signing policies should reject EIP-7702 authorizations unless they are expected."

TRM also says any such delegation on a treasury wallet should trigger an immediate alert.

Treat a policy change like a large payout: same quorum, same alert.

The SFC says cold wallet whitelist changes should be subject to "stringent controls and oversight." Hot wallet allowlists deserve no less.

Reconciliation and Automatic Halts

Reconciliation is the backstop for every rule above. The SFC says platforms should implement "real-time reconciliation" of onchain client assets with the ledger.

If unexpected transactions cause a discrepancy, the SOC "should be promptly alerted."

Korea's FSC said on April 6, 2026 that exchanges will be required to reconcile ledger and wallet balances "on a real-time basis (every five minutes)." Large mismatches are to trip an automated kill switch.

DAXA and the five major exchanges announced a joint resolution, the release says. Rule changes were planned within April 2026.

Key details are to go into what the FSC called the "currently pending framework law on digital assets." Our guide to Korea's real-time reconciliation rule tracks where it stands.

Design the halt

• Halt the signer, not the API alone. Pausing the withdrawal page leaves direct calls open.
• Know what a halt cannot undo. Binance says pausing withdrawals did not automatically invalidate authorizations already onchain.
• Rehearse revocation per wallet type, MPC included.
• Scope halts by wallet, asset and chain, so deposits keep crediting.
• Model the noise: pending deposits, sweeps, withdrawals in flight, reorgs and node lag.

Binance says its hot wallet used MPC, so "there was no single private key" that could revoke the delegations at once.

A halt that trips on noise gets switched off. Tune it until it fires only when it should, then test that it fires.

The SFC's cold wallet good-practice examples put halts at the last step too. In one, the signing terminal halts and notifies the security team when a destination is not on the whitelist.

In another, a firm compares each signed transaction with the unsigned original. On any discrepancy, it does not broadcast.

Playbooks and Evidence

An alert is only as good as the next ten minutes. The SFC says security monitoring should run "on a 24/7 basis, including during holidays," with alerts handled "according to severity levels."

Write the first moves for an unrequested outflow before you need them:

1. Halt signing for the affected wallet tier and chain.
2. Check for delegations, approvals or signed transactions still live.
3. Send stablecoin issuers the receiving addresses.
4. Rotate the credentials and tokens that reach the signer.
5. Preserve signer logs, policy history and alert records.

Speed with issuers matters. TRM says Tether's first freeze came "37 minutes after the main sweep."

Our exchange incident response plan covers the first hour.

Evidence for regulators

Keep what a supervisor will ask for:

• Every alert, who acknowledged it and when.
• Thresholds over time, and who changed them.
• Reconciliation runs, and how each break was resolved.
• Halt tests, with timings.

Some clocks are short. New York's cybersecurity regulation requires covered entities to notify the superintendent "in no event later than 72 hours after determining that a cybersecurity incident has occurred."

They must also promptly provide any information the superintendent requests about the incident.

How Guardian Helps

Guardian's institutional practice specifies trust boundaries, privileged roles, approval thresholds and key custody "before they are built rather than audited after."

Its offchain automation pentest tests threshold signers, including "whether a stuck or spammed job halts safely, and how an operator steps in mid-incident."

The infrastructure pentest covers cloud IAM and trust policies, secrets handling, build and deploy, and containers and clusters.

After launch, Managed Security watches onchain and offchain around the clock, with an MDR team on every alert.

Frequently Asked Questions

What is hot wallet monitoring?

Continuous checks that compare what a hot wallet does onchain with what the exchange intended: balances against the ledger, outflows against approved withdrawals, and changes to signers and policies. It raises alerts and can halt signing.

How often should an exchange reconcile hot wallets with its ledger?

In real time. Hong Kong's SFC says platforms should implement real-time reconciliation of onchain client assets with the ledger. Korea's FSC said in April 2026 that exchanges will be required to reconcile every five minutes, with automated kill switch criteria.

Does pausing withdrawals stop a hot wallet drain?

Not always. Binance says suspending withdrawals did not automatically invalidate EIP-7702 authorizations already onchain, which gave an attacker contract partial execution rights over a hot wallet. Halt the signer, and rehearse revocation for each wallet type.

What should trigger an automatic withdrawal halt?

A ledger mismatch beyond tolerance, an outflow with no matching withdrawal, or a velocity breach on a wallet. Scope the halt by wallet, asset and chain so deposits keep crediting, and test that it fires.

Sources

• TRM Labs: North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History (October 29, 2026)
• Binance: 29 October 2026 Binance Security Incident, Initial Findings and Response Update (November 3, 2026)
• SFC: Circular to licensed virtual asset trading platform operators on custody of virtual assets, 25EC44 (August 15, 2025)
• FSC Korea: Real-Time Balance Reconciliation and Enhanced Internal Control Required for Virtual Asset Exchanges (April 6, 2026)
• Cornell LII: 23 NYCRR 500.17, Notices to superintendent (read November 2026)
• Guardian: Institutional
• Guardian: Offchain Automation Pentest
• Guardian: Infrastructure Pentest
• Guardian: Managed Security