A senior executive at Xapo Bank said the $6.3 billion Binance hack pointed to more than a technical failure; it revealed a structural weakness at crypto exchanges and other companies with crypto exposure.
The $6.3 billion Binance hack helped trigger the broader crypto market downturn during what should have been a bullish “Uptober” in October. The crypto exchange quickly attributed the incident to a compromised laptop belonging to a DevOps engineer.
The investigation also tied the breach to 50 pre-signed authorizations that leveraged Ethereum’s (ETH) EIP-7702 and a roughly 20-minute window that allowed the hacker to drain funds. However, Joey Garcia, Executive Director, Chief Strategy, Policy and Regulatory Affairs Officer at Xapo Bank, said investigators and the public overlooked a crucial factor that contributed equally to Binance’s vulnerability.
An Overlooked Factor in the Binance Hack
According to Garcia, the broader lesson of the Binance hack was not purely technical; it was also structural. He explained that, like many crypto exchanges and other companies with crypto exposure, the platform relied on a single counterparty.
The Xapo Bank executive said the design created concentration of risk, amplifying the impact of a single point of failure.
“When a very large share of assets sits with one single counterparty, a single failure stops being an incident and becomes an event,” Garcia said. “Banks call this concentration risk. Bitcoin holders rarely use the term.”
Garcia also warned that the same vulnerability is not limited to crypto exchanges. He estimated that around 80% of US spot Bitcoin exchange-traded fund (ETF) assets rely on a single custodian.
The executive director noted that there is nothing wrong with having a single custodian, and that does not necessarily mean the custodian is insecure. However, a single outage, enforcement action, or intrusion could have a contagion effect and become a market-wide problem.
“Concentration isn’t automatically wrong,” Garcia clarified. “Unexamined concentration is.”
Moreover, Garcia emphasized that the problem is not new. Notable events that demonstrated the pitfalls of such a framework included the Lehman bankruptcy during the 2008 crisis and the Silicon Valley Bank (SVB) collapse in 2023. Both underscored the need for diversification.
Preparing for the Worst
The Xapo Bank executive said that beyond examining counterparties, customers must re-examine how institutions entrusted with their assets would respond in a crisis.
“The question to ask isn’t ‘how many counterparties do I have?’” Garcia recommended. “It’s ‘what happens to my assets if this one has its worst day?’”