The hack on Binance has once again pushed the market to discuss basic rules for storing digital assets.
On October 29, attackers targeted the exchange’s hot wallets. Binance estimated the damage at roughly $6.3 billion.
About $3 billion of the funds were frozen on-chain thanks to cooperation with stablecoin issuers and partners. This does not mean all frozen assets have already been returned to the exchange. As of November 1, the company said it had restored about 95% of the affected assets using the SAFU fund, corporate treasury resources and other internal reserves.
It has also begun a phased resumption of withdrawals. Even so, the incident has again raised a question that surfaces after every major attack: when you keep crypto on an exchange, you do not control the private keys and depend on the platform to move your assets.
Exchanges are convenient for trading and quick transactions. However, as the total assets they have under management grows, they become more interesting targets for the attackers. Although firms might compensate users for the losses they incurred, users suffer losses in access to their funds, relying on the time taken by the perpetrator to resolve the problem. Keeping all funds on an exchange is not necessary. There are other ways to store cryptocurrency.
Cold storage
The most common way to reduce risk is to move part of your assets to cold storage, where private keys remain offline. Cold options include hardware wallets and other offline solutions, such as paper backups of the seed phrase.
A seed phrase (also called a recovery phrase or mnemonic phrase) is a set of 12 to 24 words needed to restore access. The words are chosen from a list of 2,048 English words defined in Bitcoin Improvement Proposal 39 (BIP39), the standard used by most major crypto wallets.
The seed phrase is generated on the user’s device when the wallet is created and remains unchanged for the entire time the wallet is used. Words in the BIP39 list do not share common roots, are sorted in a specific way and do not match in the first four characters. This makes guessing or brute-forcing a seed phrase effectively impossible.
Software wallets that run on devices connected to the internet are usually classified as hot storage.
A hardware wallet isolates private keys from a computer or smartphone connected to the network. This reduces the risk of remote key theft, but it does not protect against all threats, for example, malicious transactions that the user confirms themselves. The seed phrase should be stored offline, preferably in several physical copies. Losing the seed phrase without a backup can lead to permanent loss of access to the assets.
Own infrastructure: an option for companies
Large companies and funds can organize cryptocurrency storage themselves without transferring control of assets to an exchange or a third-party custodian. This requires a technical team that can set up servers, keep them running and design a system for controlling access to funds.
One element of such infrastructure is running one’s own crypto nodes. These are servers that connect to the blockchain, receive and verify transaction data and allow the company to interact directly with the network. This reduces reliance on external infrastructure providers and gives more control over blockchain data processing. However, running nodes by itself does not protect private keys and does not guarantee the safety of funds.
For storing assets, a company needs a separate key management system. It determines where private keys are kept, who has access to them and who can approve transactions. One option is multisignature (multisig), where transferring funds requires approval from several authorized people. For example, in a 2-of-3 scheme, at least two of the three key holders must confirm a transaction, so no single person can move all the company’s assets alone.
Companies can also use specialized devices or systems for secure key storage, separate duties among employees, set transfer limits and require additional approval for large operations. It is important to have key backups and a predefined procedure for restoring access if a device fails or one of the responsible employees loses access.
This approach gives a company more independence: it controls its interaction with the blockchain and sets the rules for accessing assets. But responsibility for security also lies with the company.
Server configurations, lack of protection of the server, and loss or compromise of the keys can block or lose funds. Thus, self-hosting is more appropriate for those companies that have the means to maintain and monitor their infrastructure on a continuous basis.
Realistic security picture
Self-custody allows more control but imposes more responsibility. The greatest dangers are phishing sites, theft of the seed phrase, and the presence of the malicious app or fake wallets, as well as the confirmation of inappropriate transactions and excess permissions granted to the smart contracts.
It can be said that the individual or a small company will spend less on cybersecurity compared to a big exchange. At the same time, hackers do not usually target small wallets. For the majority of users some simple rules will suffice: do not leave much on the exchange, use cold storage for long-term investments and pay special attention to the seed phrase.
