[DigitalToday reporter Sang-yeop Oh] An analysis has found that a recent large-scale digital asset theft at Binance was an attack on the exchange's internal signing authority and operating system, rather than a vulnerability in the blockchain itself.

According to the digital asset industry, about $6.3 billion (about 8 trillion won) of digital assets was withdrawn without authorisation from a Binance hot wallet on Oct. 30 (Korea time). At the time, a breach of an employee work laptop and possible unauthorised access to the transaction approval and signing system were cited as the cause.

DSRV analysed the Binance hacking incident, saying, "The blockchain was not breached." It said the actual points attacked were people with signing authority and their devices, and an operating structure that allowed large amounts of assets to be moved even if a single point was compromised.

According to DSRV, indications were presented that employee devices were infected through fake job interviews and tampered packages, and that the scope of the attack expanded to other employees' devices through internal artificial intelligence tools.

It also identified key weak points as access to the signing service using distribution-authority tokens left on devices and pre-signed EIP-7702 delegation signatures. Problems also emerged in being unable to immediately revoke already granted delegation authority despite using a multi-party computation (MPC) structure intended to enhance the security of multi-asset wallets.

DSRV suggested that it is necessary to control external code execution in development environments and on work devices, and to separate the signing environment from general work devices.

It said AI tools and agents need authority controls at the same level as human accounts. It also said distribution authority should be granted only for a short period and require approvals from multiple parties. It explained that access paths to signing services should be separated, and that even if MPC and multisig are applied, separate policy verification should be carried out inside the signing node.

The hot-wallet operating method was also cited as a target for improvement. It said there is a need to set a ceiling on assets kept in hot wallets, increase the share of cold wallets, and separate signing paths depending on chain and wallet risk levels.

It also analysed that procedures are needed to show humans what they can verify, such as the actual signing target, amount and address, to prevent employees from being deceived by social engineering attacks into approving malicious signatures.

South Korean exchanges are also not free from risks such as the Binance incident.

According to DSRV, under the Virtual Asset User Protection Act, South Korean exchanges must keep at least 80 percent of users' digital assets in cold wallets. DSRV pointed out, "If the signing system is breached like in this Binance incident, damage can grow even with only the assets remaining in hot wallets."

How far user losses should be compensated when an incident occurs also remains a challenge. Under the current system, exchanges are required to secure insurance or reserves for a certain portion of hot-wallet holdings, but no-fault compensation provisions under the Electronic Financial Transactions Act do not apply to digital asset exchanges.

Financial authorities are also strengthening security checks on South Korean exchanges after the Binance incident.

At an emergency meeting on the 2nd attended by exchanges and the Financial Supervisory Service, the Financial Security Institute and the Digital Asset Exchange Alliance (DAXA), the Financial Services Commission called for raising cold-wallet ratios, around-the-clock monitoring of deposits and withdrawals, reporting and sharing abnormal access, and additional reserve accumulation.

DSRV stressed, "The answer to the question of where it is safe to store is not a specific place," adding, "It depends on whose hands the keys and signing authority pass through and how many layers of checks are required for movement."