Cryptocurrency exchanges have spent years trying to convince customers that their assets are safe. They publish proof-of-reserves reports, advertise sophisticated custody systems, and invest heavily in cybersecurity. Yet the October 2026 Binance breach has exposed a weakness in how the industry demonstrates security.
An exchange can hold sufficient assets to cover customer balances while still operating infrastructure vulnerable to unauthorized transactions. Financial transparency and operational security are related, but they measure different risks.
That distinction matters after Binance reported approximately $6.34 billion in affected digital assets following its October 29 security incident. The exchange subsequently committed to covering the losses and replenishing the affected assets.
For investors, the incident raises a question extending well beyond Binance: what evidence should a cryptocurrency exchange provide to demonstrate that its custody infrastructure can withstand a serious compromise?
Proof of Reserves Cannot Measure Every Security Risk
Proof of reserves has become an important transparency mechanism for centralized cryptocurrency exchanges. It allows customers to verify certain information about the assets held by a platform, depending on the methodology used.
However, even a properly constructed reserve report cannot establish that an exchange’s wallet infrastructure is secure.
An exchange could demonstrate that it holds sufficient Bitcoin, Ethereum, or stablecoins while simultaneously exposing those assets to weaknesses in employee permissions, transaction-signing systems, or software deployment processes.
These vulnerabilities may remain invisible in a reserve snapshot.
Binance’s November 4 recovery update illustrates the distinction. The company reported that it had replenished approximately 98% of the affected assets and expanded its proof-of-reserves coverage from 10 to 44 tokens.
Those measures provide information about asset backing and the company’s financial response. They do not independently establish whether the security weaknesses responsible for the breach have been permanently eliminated.
A more comprehensive assessment would examine both financial solvency and the controls governing access to customer funds.
Wallet Authorization Is Becoming a Critical Security Indicator
The security of an exchange’s wallets depends on more than protecting private keys.
Modern custody infrastructure can involve multiple approval systems, automated transaction services, deployment tools, and employees with different levels of access.
Each component introduces a potential point of failure.
Binance’s preliminary investigation identified unauthorized access to an internal wallet-signing service. Attackers also exploited Ethereum’s EIP-7702 authorization mechanism to establish permissions that could operate independently of the exchange’s normal withdrawal infrastructure.
This created a particularly difficult containment problem: suspending customer withdrawals did not automatically revoke the malicious on-chain authorizations.
The incident demonstrates why exchanges need to assess not only who can initiate transactions, but also how permissions are granted, monitored, restricted, and revoked.
An exchange could strengthen its defenses by separating software deployment privileges from transaction-signing authority, requiring independent approvals for high-risk operations, and enforcing transaction limits that cannot be bypassed through ordinary administrative access.
These controls should also be tested against scenarios in which attackers have already compromised legitimate employee credentials.
The relevant security question is no longer simply whether an attacker can gain access. It is how much financial damage that access could cause before independent safeguards intervene.
AI Integration Creates Another Layer of Operational Risk
The October 2026 Binance breach has intensified scrutiny of how artificial intelligence tools can introduce additional vulnerabilities into cryptocurrency exchange infrastructure. The incident attracted international attention, including coverage by The New York Times, as questions emerged about the methods used to compromise internal systems. While AI-related tools formed part of the attack environment, the available evidence does not establish that artificial intelligence independently planned or executed the theft. Instead, the case highlights how conventional techniques, including malware, social engineering, and stolen credentials, can exploit increasingly interconnected systems.
The distinction between an AI-enabled attack and an attack exploiting AI-related infrastructure is particularly important.
The distinction between an AI-enabled attack and an attack exploiting AI-related infrastructure is particularly important. As explored in a recent article on the Binance breach, the attackers combined compromised development environments, social engineering, and access to internal AI tooling. The available evidence does not establish that AI independently planned or executed the theft.
This distinction has practical consequences.
Security teams cannot assume that deploying AI-powered monitoring will compensate for excessive permissions elsewhere in their infrastructure. An automated system capable of accessing sensitive information or interacting with operational tools can become another route through which attackers move across a network.
The National Institute of Standards and Technology’s AI risk management guidance provides a broader framework for evaluating risks associated with deploying generative AI systems.
For exchanges, the priority should be ensuring that AI tools operate within clearly defined access boundaries, with sensitive financial operations subject to independent authorization.
Independent Security Audits Need a Broader Scope
Cryptocurrency companies frequently commission security audits, but the usefulness of those assessments depends on what they examine.
A smart contract audit may identify vulnerabilities in blockchain code without evaluating employee access controls, cloud infrastructure, or internal transaction-signing services.
Similarly, a financial audit does not necessarily establish that operational systems are resistant to cyberattacks.
A stronger exchange security assessment would evaluate several areas together:
- Transaction authorization: Whether sensitive transfers require independent approvals and enforceable limits.
- Employee access: Whether compromised accounts can reach critical custody infrastructure.
- Emergency response: Whether malicious permissions can be revoked rapidly across supported networks.
- Software security: Whether development environments and third-party tools are isolated from financial operations.
- Incident transparency: Whether exchanges disclose meaningful findings and corrective measures following security failures.
Independent testing would be especially valuable when it examines how these controls behave under simulated compromises rather than merely confirming that security policies exist.
Binance announced plans for an external cybersecurity review following the October incident. The value of that process will depend partly on whether its findings establish that the weaknesses identified in the preliminary investigation have been addressed.
Customers Need Better Evidence, Not More Security Promises
Most retail investors cannot independently examine an exchange’s internal infrastructure. They must rely on public disclosures, external assessments, and the platform’s demonstrated ability to protect assets.
This creates an information imbalance.
Customers may be able to verify certain reserve balances on-chain, but they generally cannot determine whether a compromised employee account could authorize unauthorized transactions.
Exchanges could narrow that gap by publishing standardized information about custody arrangements, security testing, incident response capabilities, and the independence of external assessments.
Such disclosures would not require revealing sensitive technical details that could assist attackers. They could instead establish whether important safeguards have been independently examined and whether identified deficiencies have been corrected.
The Binance incident also demonstrates why compensation should not be confused with prevention. A financially strong exchange may be capable of replacing stolen assets, but customers can still face withdrawal interruptions, uncertainty, and operational disruption.
Ultimately, the industry needs a more demanding definition of custody security.
Proof of reserves can help establish whether assets are present. Independent operational assurance must address whether those assets can be moved without authorization.
Both forms of evidence matter. Treating either one as sufficient leaves investors with an incomplete picture of the risks involved in centralized cryptocurrency custody.
