A hot wallet is what exchange heists drain first

What is a hot wallet, and why does an exchange keep one?

A wallet is a set of keys that can authorise a transfer of coins. A hot wallet keeps those keys on a machine that is online, so a withdrawal request can be signed and sent without a person in the loop. A cold wallet keeps the keys offline, and moving coins out takes a slower, deliberate step.

An exchange needs both. Thousands of customers ask to withdraw at random hours, and a wallet that waits for a human to sign each one would make the exchange unusable. So some balance sits hot to serve those requests, and the rest sits cold. You can read more on what a cold wallet protects and what it cannot.

We found no source that sets a correct split between hot and cold. The hot share is whatever the exchange decides, and a customer sees it only if the exchange chooses to show it.

How does a breach reach a hot wallet?

An attacker reaches a hot wallet by getting the system that signs transactions to sign theirs.

TRM Labs describes the October 2026 case this way. On Ethereum, the attacker used an EIP-7702 delegation to turn an exchange hot wallet into a sweeper the attacker controlled. That feature lets a wallet hand its signing power to a contract. The attacker had 50 pre-signed authorisations prepared in advance. On the other nine chains, the wallets sent funds out through ordinary signed transfers. In TRM's assessment, this points to a compromise of the hot wallet signing infrastructure, according to TRM Labs' on-chain analysis.

Al Jazeera reports that the exchange first said the breach may have started with an engineer's hacked laptop, then said its investigation found "additional points of breach". The exchange also said it found no evidence that any wallet's private key had leaked. A former head of an earlier collapsed exchange told Reuters he believed keys for at least two wallets had probably been accessed. Those two accounts were still unresolved at the time of reading. Treat the cause as unsettled. See Al Jazeera's report for the full account.

Whichever account turns out right, the blockchains worked as designed and the coins left because the company's signing process was reachable.

What did the October 2026 heist drain, in numbers?

These figures come from TRM Labs and may be revised as the investigation continues.

• Ethereum: about USD 3.79 billion, including 200,630 ETH and 185 other tokens.
• Bitcoin: 18,270 BTC, about USD 1.47 billion.
• Tron: about USD 628 million, mainly USDT.
• XRP Ledger: about USD 296 million, 233.46 million XRP.
• Solana: about USD 96 million, 970,500 SOL.

The smaller chains added roughly USD 77 million between them. TRM says issuers and one network's security council froze about USD 2.7 billion, while the attacker holds about USD 2.4 billion in assets beyond any issuer's reach.

Source: TRM Labs, "North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History", read 31 October 2026. The previous record TRM cites is the USD 1.5 billion exchange theft of February 2025.

What stands behind a customer when the hot wallet is drained?

Behind the balance on your screen sits a promise, and sometimes a fund. This case shows how to read one.

Al Jazeera reports the exchange's emergency fund was USD 1 billion, set up in 2018 and held entirely in Bitcoin. The loss is more than six times that. The exchange says it will cover the remainder from company funds and that user money is safe.

Take a hypothetical ₹25 lakh crypto position held on an exchange with a fund sized like that one. The fund covers 1 ÷ 6.36 = 0.157 of the loss, about 15.7 percent. Spread evenly, that is 0.157 × ₹25 lakh = about ₹3.93 lakh of your balance. The other ₹21.07 lakh depends on the company honouring its promise from its own resources. The arithmetic illustrates how to read a fund against a loss and says nothing about what any customer will receive.

Crime and cyber insurance is thinner than most people assume. Al Jazeera notes that most such policies do not cover stolen cryptocurrency, and crypto-specific cover is a niche business.

What can a holder check before holding coins on a platform?

You cannot audit a hot wallet from the outside. You can ask four questions of any exchange or platform where coins sit in your name.

1. Is the custody arrangement described in plain terms, and are customer assets kept separate from the company's operating money?
2. Is there a proof of reserves, and can you reach it any time without a request form? See how to read a proof of reserves before you trust one.
3. What happens to withdrawals in an incident? In this case the exchange suspended withdrawals on several networks while it rebuilt its withdrawal system. A holder who needs to move coins cannot, for as long as that lasts.
4. What does the insurance say it covers, in writing?

One more habit helps. Size any position held at a single venue as a share of the whole portfolio, and decide that share in advance. Three percent of a ₹1 crore portfolio is ₹3 lakh. If a venue fails, the loss is the share you set in advance. The earlier piece on where the coins were sitting in an earlier hack walks through the same test.

How did the market react, and what does that tell you?

Al Jazeera reports Bitcoin touched a six-week low of USD 76,368 and Ether fell to a two-month low of USD 2,178 after the news. Prices steadied after the first shock. A price move after a hack is a reaction to fear and to forced selling. It says little about the long-term value of the coins. The same dip also triggered forced closures of borrowed positions, which is what a liquidation figure measures.

How does Qatobit approach custody?

Qatobit holds user assets in institutional custody. The platform's design separates user funds from operational funds. Qatobit also publishes live Proof of Reserves, available at any time, not behind a request form or a quarterly cycle. User assets are insured. Those are the facts, and the point of listing them is the four questions above: ask them of us as you would of anyone.

What to take from this

A hot wallet exists because customers want instant withdrawals, and it fails when the system that signs for it can be reached. The number to remember is the ratio: USD 6.36 billion lost against a USD 1 billion fund. Before you hold coins anywhere, find out what stands behind the balance. After a record heist, the useful question is how much of your portfolio you decided to leave in one place.

Frequently asked questions

What is a hot wallet in crypto?

A hot wallet is a crypto wallet whose keys sit on an internet-connected system, so transfers can be signed and sent instantly. Exchanges use one to pay withdrawals quickly. It is faster than a cold wallet and easier to reach for an attacker.

Why do exchanges keep funds in a hot wallet at all?

Customers request withdrawals at any hour, and an offline wallet cannot sign them without a deliberate manual step. A hot wallet lets an exchange serve those requests at once. The cost is a larger attack surface, so exchanges choose how much balance to keep hot.

How much of an exchange's funds sit in the hot wallet?

There is no single published share that applies to every exchange, and we found none. The split is the exchange's own decision, and a customer can see it only if the exchange discloses it. Ask any platform where your coins sit what it says.

Can a hot wallet breach happen without a stolen private key?

Yes. TRM Labs says an attacker used a wallet delegation feature on Ethereum and ordinary signed transfers on nine other chains, which points to a compromise of the signing infrastructure. The exchange said it found no evidence of a leaked key. The cause remained unsettled at the time of reading.

Does a proof of reserves stop a hot wallet from being drained?

No. A proof of reserves shows that assets exist against customer balances at a point in time. It does not stop a signing breach. It lets you check that a platform holds what it says, which is why you read it alongside the custody terms.

Crypto investments are subject to market risk. Not financial advice.