You’ve probably heard about Binance’s record-breaking $6.3 billion hack. It’s easy to assume that protecting private keys keeps funds safe, yet Binance reported no evidence that its keys had leaked.
Similar failures had already surfaced at Bybit and Drift, where attackers exploited the processes used to authorise transactions.
So how can attackers move funds without stealing the keys? And how can you protect institutional funds?
Sam Eiderman, Utila’s CTO and Co-founder, has written a detailed analysis of the attack and the lessons institutions can apply to their digital asset operations.
In the article, you’ll find:
A reconstruction of the attack, covering the amounts stolen, transaction timelines and affected wallets.
Published findings from our compliance partners Chainalysis, Elliptic and TRM Labs, tracing fund movements and efforts to freeze stolen assets.
Technical details from our threat monitoring integration partners Blockaid and Hypernative, explaining how malicious authorisations enabled the theft.
Sam’s assessment of the recurring failures across Binance, Bybit and Drift, with recommendations for limiting wallet exposure, enforcing independent signing checks and protecting policy changes.
Resources to Help Review Your Controls
We built Utila to help prevent this class of failure through secure key management and independently governed transaction policies. These resources explain the risks and the controls available:
EVM Contract and EIP-712 Controls: How our infrastructure restricts contract interactions and the permissions granted through signed messages.
Verified Exchange Deposit Addresses: How quorum-signed addresses help detect tampering before funds move.
Protecting the institutions building on digital assets drives our work every day. As attackers evolve, we keep strengthening our platform and our own operational security.
We hope this analysis helps your team turn the lessons into stronger safeguards. If you have questions or would like to review how these controls apply to your operations, schedule a call here.
We’re here to help.
The Utila Team
