“What stands out most about the Binance hack is that it wasn’t a case of private keys being compromised,” Ye told Edaily in a recent interview at RigSec‘s headquarters in the International Commerce Centre in Kowloon, Hong Kong. “The attackers were able to bypass security controls, gain direct access to the signing system and execute transactions. Simply keeping private keys secure is no longer enough.”
|
“Financial institutions need to verify not only who is authorized to sign a transaction, but also exactly what they are signing,” she said.
RigSec provides institutional digital asset wallets and custody infrastructure across major Asian financial markets, including Hong Kong, Singapore and Japan. As of the end of 2025, about 40% of virtual asset trading platforms licensed by Hong Kong’s Securities and Futures Commission (SFC) had adopted its solutions.
In a technical report on the Binance breach, RigSec said attackers bypassed the exchange‘s security controls and abused hot-wallet signing privileges across multiple blockchains to execute unauthorized transactions.
The firm highlighted the near-simultaneous execution of unauthorized asset transfers carrying valid cryptographic signatures across blockchains with different signing architectures, including Bitcoin, Tron, XRP and Solana.
On Ethereum, the attackers allegedly exploited the delegation mechanism introduced under EIP-7702 as part of the network’s Pectra upgrade.
According to RigSec‘s analysis, the attackers generated 50 validly signed EIP-7702 authorizations and used a malicious smart contract to take control of transaction execution permissions for Binance’s Ethereum hot wallet. They then drained the wallet‘s balance in a single transaction.
“We believe fraudulent transaction requests that should never have existed were generated, and the system treated them as legitimate and signed them,” Ye said.
“Even if a signing service protects private keys perfectly, it may still fail to prevent asset theft if the transaction request itself has been manipulated.”
RigSec described the incident as exposing a structural weakness in what it calls passive signing.
Traditional security systems have focused primarily on verifying the identity and authority of the person requesting a signature, as well as protecting the underlying private keys. Ye argued that the industry needs to move toward intent-based transaction signing, in which systems independently verify whether a transaction matches its originally authorized purpose.
Such safeguards are particularly important for hot wallets, where transactions are often processed automatically without human intervention.
“Hot wallets frequently execute transactions without direct human involvement,” Ye said. “Immediately before signing, multiple internal systems, including risk management and transaction processing systems, should cross-check the request to detect and block fraudulent transactions.”
She also warned that artificial intelligence is making software-based cyberattacks faster and more effective, while laptops and smartphones used by transaction approvers are becoming increasingly attractive targets.
“Independent trusted hardware should be incorporated into the approval process to protect the actual intent of the person authorizing a transaction,” she said.
Ye said the Binance incident should serve as a warning to South Korean financial institutions preparing to enter the digital asset market.
As banks and securities firms expand their digital asset businesses, they will need security systems that protect not only the assets themselves but also the entire transaction approval process, she said.
“AI is dramatically increasing the speed and scale of cyberattacks,” Ye said. “As many digital assets as possible should be kept in air-gapped cold wallets that are completely disconnected from the internet. Moving those assets should require physical access and strict control procedures.”
Under South Korea’s Virtual Asset User Protection Act, crypto service providers must keep at least 80% of the economic value of customer virtual assets in cold wallets.
Hong Kong, by comparison, generally requires licensed virtual asset trading platforms to hold 98% of customer assets in cold storage.
Ye suggested that South Korean regulators could draw lessons from Hong Kong‘s approach.
“In the past, I thought Hong Kong’s regulatory requirements were too strict and difficult to implement,” she said. “But looking at recent hacking incidents, I now think they were a wise decision.”
Hong Kong has translated the broad principle of asset protection into specific, verifiable operational requirements, including 98% cold-storage holdings, independent transaction verification and third-party security audits, she said.
In some cases, regulators also require certification of internal firmware, going beyond conventional hardware security module (HSM) requirements.
“When regulatory requirements are clear, financial institutions know what security infrastructure they need to build and what they must verify in their day-to-day operations,” Ye said.
She added that on-site inspections and ongoing supervision are essential to ensure regulations keep pace with emerging attack methods and lessons learned from security breaches.
Ye also called for stronger standards to evaluate existing security technologies.
Multi-party computation (MPC) is widely used in digital asset custody, but implementations vary significantly among vendors, making it difficult to assess their security consistently, she said.
HSM technology, by contrast, has been used in traditional finance for decades and benefits from established international security certification frameworks.
RigSec is stepping up efforts to establish partnerships with South Korean financial institutions as it expands its regional business.
“South Korea is a very high priority in our near-term global expansion strategy,” Ye said. “We are in discussions with potential local partners who could support our market entry and help customers adopt our solutions.”
South Korea‘s strict network-separation rules and data-control requirements are among the factors shaping RigSec’s strategy.
“Korean financial institutions want direct control not only over their private keys, but also over their business data, internal security policies, networks and daily operations,” Ye said.
“External cloud-based software-as-a-service solutions may struggle to meet those requirements.”
RigSec uses an on-premises deployment model, installing wallet and security infrastructure directly within a financial institution‘s own systems.
The approach is designed to give customers direct control over their private keys, assets, data and operational policies.
The company says its technology combines HSM-based private-key management with a proprietary personal security device (PSD) to reduce the risk of transaction manipulation.
The device allows an authorized user to review transaction details independently and verify that they match the information being signed.
RigSec is also drawing on its experience operating across six regulated Asian markets as it targets South Korea.
“After Bybit suffered a hack of approximately $1.5 billion last year, it selected RigSec’s cold-wallet solution to protect customer assets globally,” Ye said.
“Multiple exchanges among the world‘s top 10 are using our solutions.”
Ye said South Korea’s digital asset custody market remains at an early stage but expects demand for institutional-grade infrastructure to grow as the country‘s digital asset financial sector develops.
“Banks and platform companies don’t necessarily have to operate custody businesses themselves,” she said. “But whatever digital asset business they enter, they will need infrastructure that ensures secure asset storage and control.”
She sees custody as the foundation for a broader range of blockchain-based financial services.
“Custody is the foundation of every digital asset financial service,” Ye said.
“In the long run, we want to support financial institutions as they build on custody infrastructure and expand into asset tokenization, stablecoin issuance, payments, staking and decentralized finance.”
![논란의 조작기소특검, ‘호남·50대·與 지지층'만 과반 찬성 [여론 뒤집기]](https://image.edaily.co.kr/images/vision/files/NP/S/2026/11/PS26111101133t.jpg)