CoinEx founder Haipo Yang has accused Binance of failing to follow three basic security practices that he believes could have prevented the $6.3 billion cryptocurrency theft on October 29.
Summary
- CoinEx founder Haipo Yang has identified three security weaknesses he believes contributed to Binance’s $6.3 billion hack.
- Yang criticized inadequate separation of work environments, weak authentication and insufficient verification by transaction signers.
- Binance’s investigation traced the attack to compromised employee devices, fraudulent recruitment and stolen credentials.
- Co-CEO Richard Teng said Binance has replenished 98% of affected assets and completed its latest Proof of Reserves verification.
- Binance co-CEO Yi He reported that the exchange had blocked 57 suspected North Korea-linked cyber threats during 2026.
In a post on X, Yang criticized the exchange’s handling of production access, employee authentication and transaction signing. He argued that the attack exposed failures in operational discipline, not shortcomings in available security technology.
“None of these require sophisticated technology. What was missing was discipline,” Yang wrote.
His criticism followed Binance’s publication of an initial incident report detailing how attackers compromised employee devices and gained access to systems responsible for cryptocurrency withdrawals.
CoinEx founder identifies three security failures at Binance
Yang’s first criticism concerned the separation of development and production environments.
He argued that employees with access to live financial systems should use dedicated computers without unrelated software. Development work, communication and web browsing should take place on separate devices.
According to Yang, Binance had not maintained sufficient separation between those activities, leaving sensitive systems exposed when an employee’s device was compromised.
His second concern involved authentication controls. Yang claimed that a single stolen credential could provide access to production services without meaningful additional verification.
He recommended hardware security keys alongside tools such as AWS Session Manager to prevent attackers from gaining access through one compromised credential.
The third criticism focused on multi-party computation, or MPC, which distributes transaction-signing responsibilities across separate participants.
Yang argued that Binance’s signing parties failed to independently examine the transactions they approved.
He claimed the arrangement effectively operated like a single-signature system because compromising one participant could undermine the entire process.
“Multisig only works when the signers are mutually distrustful,” Yang wrote.
The allegations represent Yang’s assessment of the incident. Binance has not publicly confirmed every internal control weakness he described.
Binance report details fake interviews and compromised devices
Binance’s November 3 incident report traced the attack to a campaign that began several months before the theft.
In June, a wallet operations engineer downloaded a modified Homebrew installer while attempting to install an AI coding tool.
Binance said its security team detected the suspicious activity, replaced the affected computer and rotated related credentials.
However, the incident exposed information about employees working on the exchange’s wallet infrastructure.
In September, attackers targeted another engineer through a fraudulent recruitment process, eventually persuading the employee to download malicious software.
By October 20, the attackers had used compromised devices and an internal AI tool to access additional engineering systems.
Nine days later, stolen credentials enabled the deployment of malicious code involved in the unauthorized withdrawals.
Earlier, crypto.news reported investigators linking the attack to North Korea’s TraderTraitor hacking unit.
The Federal Bureau of Investigation subsequently attributed the theft to North Korean state-sponsored attackers, while North Korea rejected the allegations.
Binance’s report said the attackers combined social engineering, malware and compromised internal systems to gain access to its wallet infrastructure.
Richard Teng says Binance has restored 98% of affected assets
While Yang questioned the exchange’s security practices, Binance co-CEO Richard Teng defended the company’s recovery efforts.
In a November 3 statement, Teng said Binance had replenished 98% of the cryptocurrency assets affected by the incident.
“The difference is verification, not just promises,” Teng wrote, referring to the exchange’s latest reserve verification.
Binance had previously completed its Proof of Reserves verification covering ten major cryptocurrencies, including Bitcoin, Ethereum, BNB and XRP.
The report allows customers holding those assets to check whether their account balances are backed by sufficient reserves.
However, the verification establishes asset backing for the covered tokens, not whether the vulnerabilities identified by Yang have been eliminated.
Binance said approximately $2.85 billion in affected assets had been frozen or intercepted during recovery efforts.
The company has committed to covering the full financial loss using its corporate resources and reserve funds.
Teng said the exchange would continue restoring the remaining affected assets, including less-liquid cryptocurrencies that require additional purchases.
Yi He says Binance blocked 57 suspected North Korean threats
Binance co-CEO Yi He separately addressed the exchange’s security record in a November 3 post.
She said Binance’s security team had detected and prevented 57 suspected North Korea-linked cyber threats during 2026.
The attempts included fraudulent job interviews, malicious developer tools, compromised software packages and fake video conferencing applications.
Attackers had also used browser extensions and social engineering techniques to steal credentials or install remote-access malware, according to Yi He.
“We intercepted many of them, but the cost of failing to stop even one was severe,” she wrote.
Binance said it has since rebuilt affected wallet systems, replaced compromised devices and disabled credentials associated with the attack.
The exchange has strengthened wallet security controls and expanded automated monitoring for suspicious employee and system activity.
Its recovery efforts have included restoring withdrawals across more Ethereum and Solana assets after the initial suspension.
Binance plans an independent cybersecurity review and further investment in device protection, developer security and threat detection.
The company said some security measures would remain confidential to prevent attackers from identifying weaknesses in its defenses.
