A reported $6.3 billion unauthorized transfer from a Binance hot wallet on Oct. 29 has renewed attention on a security weakness that reaches beyond stolen private keys: attackers who penetrate internal systems may be able to trigger valid-looking withdrawals through the same operational controls exchanges use every day. A comparison of four perpetual-futures decentralized exchanges finds that only Lighter offers users an on-chain route to exit without continued cooperation from operator-controlled signing systems.
Binance said an attacker compromised a DevOps engineer's laptop, gained access to internal services and initiated withdrawals without evidence that private keys had leaked. The company said roughly $3 billion had been frozen and that it would cover losses.
The incident follows a similar pattern described in a separate breach at Bitget a month earlier. Bitget lost more than $350 million after an attacker accessed a backend system supplying transaction data to signers, allowing withdrawals to receive valid signatures. In both cases, the reported point of failure sat in the systems surrounding custody keys rather than in the cryptography securing those keys themselves.
Internal approvals become a high-value target
TRM Labs said the Ethereum portion of the Binance attack appeared to involve an EIP-7702 delegation, an authorization format that can allow an externally owned wallet to delegate control to a smart contract. According to TRM's account, the attacker gained approval from Binance's signing system to assign one hot wallet to an attacker-controlled contract.
The researchers said the apparent weakness was a security filter designed to block recognized harmful actions rather than one that allowed only pre-approved transaction types. A newer authorization mechanism could therefore have passed through the controls.
Binance has not confirmed that account of the Ethereum transactions. The proposed mechanism also does not explain activity involving Bitcoin, Solana or Tron, which use different transaction models. Yet the episode places renewed focus on a practical question for users of on-chain trading venues: if operational systems are breached, can funds leave without each user authorizing the withdrawal, and can users recover assets if those systems stop functioning?
That question matters particularly for perpetual DEXs, which often combine smart contracts with sequencers, validators, price-oracle services, multisignature wallets and off-chain risk engines. Moving funds from a centralized exchange into a protocol does not automatically remove reliance on privileged operators. The design of the withdrawal path determines whether a compromised operator can directly move customer balances or merely disrupt service.
Lighter offers a forced-exit mechanism
Lighter holds about $1 billion in Ethereum smart contracts, including approximately $556 million in USDC and $430 million in LIT, according to the protocol's on-chain balances. Its standard withdrawal mechanism sends assets only to the account-owner wallet established at the first deposit, and batches must be validated through zero-knowledge proofs before they are released.
A zero-knowledge proof allows the protocol to demonstrate that state changes, such as balances and withdrawals, follow its rules without publishing every detail of the calculation. Under Lighter's model, transferring funds to another account or using an accelerated withdrawal requires a wallet signature. Control of the sequencer, prover or validator infrastructure alone would therefore not authorize a redirect of standard withdrawals to an attacker's address.
The stronger protection is a forced-withdrawal route on Ethereum. A user can submit a withdrawal request directly to the protocol's base-layer contracts. If it remains unprocessed for 14 days, any participant can place Lighter into desert mode. That mode halts upgrades and enables users to leave using balance proofs derived from Ethereum data.
The system does not eliminate every operational risk. L2BEAT has flagged that Lighter's index and mark prices come from the operator, while its proof system does not verify oracle signatures. A compromised or malfunctioning oracle could affect liquidations and trade fairness even if it could not straightforwardly redirect custodial assets.
Lighter also has two guardian keys that can pause batch processing and withdrawals for limited periods: one for up to 24 hours and another for up to 72 hours, each subject to cooldown restrictions. Its upgrade system is less restrained than the forced-exit design. A 3-of-5 multisig is expected to give 21 days' notice before an upgrade, but a 4-of-7 security committee can bypass that delay. The fast-track route has been used for every upgrade so far, including five replacements of the proof verifier in October.
The protocol experienced several service interruptions, including roughly 4.5 hours of downtime on Oct. 10, 2025, delays following the LIT launch in late December 2025, and further state-update disruptions in October 2026. No losses of custodial funds were publicly reported in those events.
Hyperliquid's reserves rely on external control points
Hyperliquid's backing structure illustrates a different trade-off. About $6.5 billion in USDC is spread among a reserve wallet on HyperEVM associated with Coinbase, Circle's CoreDepositWallet contract, and an older Arbitrum bridge, according to on-chain data cited in the review.
About $5.6 billion, or 86% of that USDC, sits in the Coinbase reserve wallet. The address is controlled by a single private key, while Hyperliquid can also use chain-level system transactions to shift USDC between that wallet and Circle's contract to maintain a target balance ratio. Coinbase has staked 506,000 HYPE, valued at roughly $46 million in the reviewed material, but that stake represents less than 1% of the reserve wallet's balance.
Circle's contract is upgradeable through a single-address administrator, and the chain can move USDC directly from it. The Arbitrum bridge uses a 3-of-4 validator signing requirement and includes a 200-second interception period. Circle can also freeze native USDC, an external control that reportedly helped freeze $823 million associated with the Binance theft before it moved further.
Hyperliquid's spot assets introduce another multisignature layer. Unit, which routes spot BTC, ETH and SOL exposure, reports $940 million across 14 assets. Its vaults require two of three signatures from Unit, Hyperliquid and Infinite Field. Unit added delays to deposits and withdrawals after the Binance incident, adding friction that may limit rapid unauthorized movement but also leaves users dependent on the operators maintaining the process.
The protocol's validator structure adds further concentration. Hyperliquid lists 27 active validators, while five operated by the Hyper Foundation account for 47% of staked weight. Its node software is closed-source and distributed as a single binary signed with Hyper Foundation keys. During the March 2025 JELLY squeeze, validators voted to delist the market and settle it at a chosen price after a protocol liquidity vault was exposed, demonstrating the extent to which governance operators can intervene during market stress.
Aster and Variational retain operator withdrawal authority
Aster reports about $500 million across vaults on BNB Chain, Ethereum, Arbitrum and Solana, excluding roughly $1 billion in ASTER and APX held in a BNB Chain vault. Its funds are pooled, with balances recorded on Aster Chain, whose validators are currently operator-controlled.
For EVM vaults, withdrawals must be initiated by an operator address and signed by two Aster keys. User signatures establish that a withdrawal was requested, but do not independently authorize the release of pooled assets. Hourly caps of $30 million on BNB Chain and Ethereum and $20 million on Arbitrum can slow outflows, yet the same multisig can alter roles and raise caps immediately. There is no user-facing contract function allowing users to bypass the operator withdrawal flow.
Variational holds about $290 million in USDC on Arbitrum, including $223 million in settlement pools. Its users deposit to pools but cannot directly withdraw from them. Any one of 17 operator keys can execute withdrawals, and the contracts impose no on-chain amount cap. A single administrator wallet can add keys, pause withdrawals or move pools to a different oracle contract without a timelock.
Neither Aster nor Variational provides a forced-exit or emergency-withdrawal function in the reviewed contract designs. Their controls can restrain transaction speed or halt withdrawals, but do not give users an independent claim path if backend signing, administrative systems or oracle operations fail.
The Binance and Bitget episodes show why that distinction has become more urgent. Private keys remain a critical security boundary, but internal authorization tools, signer inputs and administrative access now form equally valuable targets. For traders assessing perpetual DEX custody risk, withdrawal caps and multisignature wallets may reduce the pace of a loss; an enforceable, on-chain exit mechanism determines whether users can recover control when the operators behind those safeguards cannot.
Worried about internal hacks and wallet safety? Learn how crypto security breaches happen and protect your exchange funds.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
