Binance co-founder CZ: A hack of this scale means serious security failures occurred, but that cannot be an excuse

Changpeng Zhao co-founded Binance in 2017 and served as CEO until November 2023, when he resigned following charges related to the U.S. Department of Justice and was sentenced to four months in prison. He is currently speaking in his capacity as a major shareholder, clearly stating that he no longer manages Binance.com's day-to-day operations, but still retains shareholder rights and continues to publicly comment on company matters. This statement continues his earlier practice of publicly confirming at the outset of the incident that it “looks like a hack” and emphasizing user fund security, highlighting the lasting influence of his dual role as founder and passive shareholder.

Binance released its initial incident report on November 3, disclosing that about $6.34 billion in digital assets were affected on October 29, and that the attack was a multi-stage operation: a supply-chain attack through a modified Homebrew installation package in June, social engineering through fake interviews in September to implant malware, the use of an internal AI tool on October 20 to expand privileges, and the eventual theft completed through a wallet signing service on October 29, with continued asset transfers using mechanisms such as EIP-7702. The report said more than 100% coverage funds had been reserved, 98% of the affected token assets had been replenished as of October 31, about $2.85 billion had been frozen or intercepted, and FBI information indicated that North Korea was responsible. This echoes CZ's statement that the public explanation simplified an attack that lasted months or years, showing that the company had proactively disclosed a long preparation period rather than a single-point failure.

Compared with Bybit's roughly $1.5 billion hack in 2025, which was also attributed by the FBI to the TraderTraitor/North Korea-related group and involved malicious code injection into the multisig front end, both incidents relied on social engineering and abuse of internal privileges rather than direct private-key leakage. However, Binance's case was larger in scale, involved internal AI tools and multiple engineers' devices, and the company chose to publicly disclose the detailed technical path and coverage progress within days. Compared with Binance's own 2019 hot-wallet incident involving about 7,000 BTC, which was fully covered by the SAFU fund and caused no losses to users, this incident was two orders of magnitude larger and had a longer preparation period, indicating a more targeted escalation by the attackers toward developers' devices and internal tools.

This incident has changed Binance's security narrative for users and the industry: the platform has shifted from “user fund security, losses fully covered” to proactively acknowledging that “serious security failures occurred” and should have been prevented, while, as a shareholder, demanding continued transparency and improvement. For the industry, developers' devices becoming high-value targets and internal AI tools being turned against them means that relying solely on multisig or MPC is no longer sufficient to withstand sustained nation-state-level infiltration; the indicators to watch will be the degree of public disclosure in independent security reviews, the actual deployment effectiveness of AI anomaly detection, and the interception rate of similar future social engineering attempts.

ABAB News · Cognitive Law

1. The larger the scale of the attack, the harder it is to use “there is no absolute security” as an excuse, because what is exposed are specific weaknesses that could have been prevented.

2. Publicly simplifying the attack path still allows the industry to see the full infiltration chain from the supply chain to internal AI tools.

3. When a founder steps down but still demands transparency as a shareholder, it means that exiting control does not mean a complete separation from security responsibility.